@amistio/cli 0.1.54 → 0.1.56

package/dist/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { createHash as createHash9, randomUUID as randomUUID3 } from "node:crypto";
-import { writeFile as writeFile12 } from "node:fs/promises";
-import os9 from "node:os";
-import path19 from "node:path";
+import { createHash as createHash9, randomUUID as randomUUID4 } from "node:crypto";
+import { writeFile as writeFile13 } from "node:fs/promises";
+import os10 from "node:os";
+import path20 from "node:path";
 import { Command } from "commander";
 
 // ../shared/src/schemas.ts
@@ -3302,8 +3302,8 @@ var toolSessionMutationSchema = z3.object({
 });
 function resolveApiUrl(apiUrl, urlPath) {
   const base = apiUrl.endsWith("/") ? apiUrl.slice(0, -1) : apiUrl;
-  const path20 = urlPath.startsWith("/") ? urlPath : `/${urlPath}`;
-  return new URL(`${base}${path20}`);
+  const path21 = urlPath.startsWith("/") ? urlPath : `/${urlPath}`;
+  return new URL(`${base}${path21}`);
 }
 
 // src/orchestrator.ts
@@ -3622,6 +3622,7 @@ function createDurableResultFinalizationEntry(input, now = (/* @__PURE__ */ new
   });
 }
 function createImplementationFinalizationEntry(input, now = (/* @__PURE__ */ new Date()).toISOString()) {
+  const telemetry = normalizeImplementationFinalizationTelemetry(input.telemetry);
   return implementationFinalizationEntrySchema.parse({
     schemaVersion: 1,
     kind: "implementationFinalization",
@@ -3635,7 +3636,7 @@ function createImplementationFinalizationEntry(input, now = (/* @__PURE__ */ new
     attempt: input.attempt,
     idempotencyKey: input.idempotencyKey,
     finalStatus: input.finalStatus,
-    telemetry: input.telemetry,
+    telemetry,
     retryCount: 0,
     createdAt: now,
     updatedAt: now
@@ -3830,6 +3831,18 @@ function implementationFinalizationEntryKey(entry) {
   const hash = createHash2("sha256").update([entry.accountId, entry.projectId, entry.repositoryLinkId, entry.runnerId, entry.workItemId, String(entry.attempt), entry.idempotencyKey].join("\0")).digest("hex").slice(0, 32);
   return `implementation-finalization-${hash}`;
 }
+function normalizeImplementationFinalizationTelemetry(telemetry) {
+  const { repositoryLockId, ...rest } = telemetry;
+  const boundedRepositoryLockId = boundTelemetryIdentifier(repositoryLockId, 200);
+  return { ...rest, ...boundedRepositoryLockId ? { repositoryLockId: boundedRepositoryLockId } : {} };
+}
+function boundTelemetryIdentifier(value, maxLength) {
+  const trimmed = value?.trim();
+  if (!trimmed) return void 0;
+  if (trimmed.length <= maxLength) return trimmed;
+  const hash = createHash2("sha256").update(trimmed).digest("hex").slice(0, 32);
+  return `sha256:${hash}:length:${trimmed.length}`;
+}
 function truncateLocalError(error) {
   const trimmed = error.trim();
   return trimmed.length > 600 ? `${trimmed.slice(0, 600)}...` : trimmed;
@@ -6245,6 +6258,191 @@ async function checkRunnerWatchGitPreflight(options) {
   return { status: "blocked", exitCode: 1, message, readiness: readiness2 };
 }
 
+// src/runner-active-claims.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { chmod as chmod3, mkdir as mkdir9, readFile as readFile9, rm as rm3, stat as stat4, writeFile as writeFile9 } from "node:fs/promises";
+import os6 from "node:os";
+import path11 from "node:path";
+var activeClaimLockStaleMs = 3e4;
+var activeClaimLockRetryMs = 20;
+var activeClaimLockAttempts = 50;
+var maxStoredActiveClaims = 100;
+var LocalRunnerActiveClaimStore = class {
+  constructor(filePath = defaultActiveClaimStorePath()) {
+    this.filePath = filePath;
+  }
+  filePath;
+  operation = Promise.resolve();
+  async reserve(input) {
+    return this.withLockedStore(async () => {
+      const now = /* @__PURE__ */ new Date();
+      const data = normalizeActiveClaimFile(await this.read());
+      data.activeClaims = pruneExpiredClaims(data.activeClaims, now.getTime());
+      const conflict = data.activeClaims.find((record2) => activeClaimConflicts(record2, input));
+      if (conflict) {
+        return { status: "blocked", reason: activeClaimConflictReason(conflict, input), existing: conflict };
+      }
+      const record = {
+        ...input,
+        reservationId: `runner_claim_${randomUUID3()}`,
+        processId: process.pid,
+        reservedAt: now.toISOString(),
+        updatedAt: now.toISOString()
+      };
+      data.activeClaims = [...data.activeClaims, record].slice(-maxStoredActiveClaims);
+      await this.write(data);
+      return { status: "reserved", record };
+    });
+  }
+  async release(reservationId) {
+    await this.withLockedStore(async () => {
+      const data = normalizeActiveClaimFile(await this.read());
+      const activeClaims = data.activeClaims.filter((record) => record.reservationId !== reservationId);
+      if (activeClaims.length === data.activeClaims.length) {
+        return;
+      }
+      await this.write({ activeClaims });
+    });
+  }
+  async listActive(now = Date.now()) {
+    return this.withLockedStore(async () => {
+      const data = normalizeActiveClaimFile(await this.read());
+      const activeClaims = pruneExpiredClaims(data.activeClaims, now);
+      if (activeClaims.length !== data.activeClaims.length) {
+        await this.write({ activeClaims });
+      }
+      return activeClaims;
+    });
+  }
+  async withLockedStore(operation) {
+    return this.withProcessLock(async () => {
+      const release = await this.acquireFileLock();
+      try {
+        return await operation();
+      } finally {
+        await release();
+      }
+    });
+  }
+  async withProcessLock(operation) {
+    const previous = this.operation;
+    let releaseProcessLock = () => void 0;
+    this.operation = new Promise((resolve) => {
+      releaseProcessLock = resolve;
+    });
+    await previous.catch(() => void 0);
+    try {
+      return await operation();
+    } finally {
+      releaseProcessLock();
+    }
+  }
+  async acquireFileLock() {
+    const lockPath = `${this.filePath}.lock`;
+    await mkdir9(path11.dirname(this.filePath), { recursive: true });
+    for (let attempt = 0; attempt < activeClaimLockAttempts; attempt += 1) {
+      try {
+        await mkdir9(lockPath);
+        return async () => {
+          await rm3(lockPath, { recursive: true, force: true });
+        };
+      } catch (error) {
+        if (!isNodeErrorCode(error, "EEXIST")) {
+          throw error;
+        }
+        await removeStaleLock(lockPath, Date.now());
+        await delay(activeClaimLockRetryMs);
+      }
+    }
+    throw new Error("Could not acquire local runner active-claim lock.");
+  }
+  async read() {
+    try {
+      return JSON.parse(await readFile9(this.filePath, "utf8"));
+    } catch {
+      return { activeClaims: [] };
+    }
+  }
+  async write(data) {
+    await mkdir9(path11.dirname(this.filePath), { recursive: true });
+    await writeFile9(this.filePath, JSON.stringify(data, null, 2), { encoding: "utf8", mode: 384 });
+    await chmod3(this.filePath, 384);
+  }
+};
+var defaultRunnerActiveClaimStore = new LocalRunnerActiveClaimStore();
+function activeClaimConflictMessage(result) {
+  if (result.reason === "sameLane") {
+    return `Runner lane ${result.existing.claimLaneId} is already working on ${result.existing.workItemId}.`;
+  }
+  if (result.reason === "sameWorktree") {
+    return `Runner worktree ${result.existing.worktreeKey} is already reserved by lane ${result.existing.claimLaneId}.`;
+  }
+  return `Runner work item ${result.existing.workItemId} is already reserved by lane ${result.existing.claimLaneId}.`;
+}
+function defaultActiveClaimStorePath() {
+  return path11.join(os6.homedir(), ".config", "amistio", "active-runner-claims.json");
+}
+function normalizeActiveClaimFile(value) {
+  if (!value || typeof value !== "object" || !("activeClaims" in value)) {
+    return { activeClaims: [] };
+  }
+  const activeClaims = value.activeClaims;
+  if (!Array.isArray(activeClaims)) {
+    return { activeClaims: [] };
+  }
+  return {
+    activeClaims: activeClaims.filter(isRunnerActiveClaimRecord)
+  };
+}
+function isRunnerActiveClaimRecord(value) {
+  if (!value || typeof value !== "object") return false;
+  const record = value;
+  return typeof record.reservationId === "string" && typeof record.accountId === "string" && typeof record.projectId === "string" && typeof record.repositoryLinkId === "string" && typeof record.runnerId === "string" && typeof record.claimLaneId === "string" && typeof record.workItemId === "string" && typeof record.attempt === "number" && typeof record.expiresAt === "string" && typeof record.reservedAt === "string" && typeof record.updatedAt === "string" && typeof record.processId === "number";
+}
+function pruneExpiredClaims(records, now) {
+  return records.filter((record) => {
+    const expiresAt = Date.parse(record.expiresAt);
+    return Number.isFinite(expiresAt) && expiresAt > now;
+  });
+}
+function activeClaimConflicts(record, input) {
+  if (record.accountId !== input.accountId || record.projectId !== input.projectId || record.repositoryLinkId !== input.repositoryLinkId) {
+    return false;
+  }
+  if (record.runnerId === input.runnerId && record.claimLaneId === input.claimLaneId) {
+    return true;
+  }
+  if (record.workItemId === input.workItemId) {
+    return true;
+  }
+  return Boolean(record.worktreeKey && input.worktreeKey && record.worktreeKey === input.worktreeKey);
+}
+function activeClaimConflictReason(record, input) {
+  if (record.runnerId === input.runnerId && record.claimLaneId === input.claimLaneId) {
+    return "sameLane";
+  }
+  if (record.workItemId === input.workItemId) {
+    return "sameWorkItem";
+  }
+  return "sameWorktree";
+}
+async function removeStaleLock(lockPath, now) {
+  try {
+    const lockStat = await stat4(lockPath);
+    if (now - lockStat.mtimeMs > activeClaimLockStaleMs) {
+      await rm3(lockPath, { recursive: true, force: true });
+    }
+  } catch {
+    return;
+  }
+}
+function isNodeErrorCode(error, code) {
+  return typeof error === "object" && error !== null && error.code === code;
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
 // src/runner-patch-drift.ts
 var patchDriftPatterns = [
   { signature: "applyPatchVerificationFailed", pattern: /apply_patch\s+verification\s+failed/i },
@@ -6307,9 +6505,9 @@ ${options.detail}`);
 // src/runner-service.ts
 import { spawn as spawn3 } from "node:child_process";
 import { createHash as createHash5 } from "node:crypto";
-import { mkdir as mkdir9, readFile as readFile9, rm as rm3, writeFile as writeFile9 } from "node:fs/promises";
-import os6 from "node:os";
-import path11 from "node:path";
+import { mkdir as mkdir10, readFile as readFile10, rm as rm4, writeFile as writeFile10 } from "node:fs/promises";
+import os7 from "node:os";
+import path12 from "node:path";
 function detectRunnerServicePlatform(platform = process.platform) {
   if (platform === "darwin") return "launchd";
   if (platform === "linux") return "systemd";
@@ -6320,19 +6518,19 @@ function createRunnerServiceDescriptor(input) {
   if (platform === "unsupported") {
     throw new Error("Startup services are supported for user-level launchd on macOS and systemd user services on Linux.");
   }
-  const homeDir = input.homeDir ?? os6.homedir();
+  const homeDir = input.homeDir ?? os7.homedir();
   const serviceName = runnerServiceName(input);
   const serviceFilePath = runnerServiceFilePath(platform, serviceName, homeDir);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const command = [input.executablePath ?? process.execPath, input.scriptPath ?? process.argv[1], ...input.args];
-  const logPath = path11.join(input.metadataDir ?? defaultRunnerMetadataDir(), `${runnerServiceKey(input)}.service.log`);
+  const logPath = path12.join(input.metadataDir ?? defaultRunnerMetadataDir(), `${runnerServiceKey(input)}.service.log`);
   const metadata = {
     schemaVersion: 1,
     accountId: input.accountId,
     projectId: input.projectId,
     repositoryLinkId: input.repositoryLinkId,
     runnerId: input.runnerId,
-    rootDir: path11.resolve(input.rootDir),
+    rootDir: path12.resolve(input.rootDir),
     apiUrl: input.apiUrl,
     serviceName,
     serviceFilePath,
@@ -6349,9 +6547,9 @@ function createRunnerServiceDescriptor(input) {
 }
 async function installRunnerService(input, options = {}) {
   const descriptor = createRunnerServiceDescriptor(input);
-  await mkdir9(path11.dirname(descriptor.metadata.serviceFilePath), { recursive: true });
-  await mkdir9(input.metadataDir ?? defaultRunnerMetadataDir(), { recursive: true });
-  await writeFile9(descriptor.metadata.serviceFilePath, descriptor.content, { encoding: "utf8", mode: 384 });
+  await mkdir10(path12.dirname(descriptor.metadata.serviceFilePath), { recursive: true });
+  await mkdir10(input.metadataDir ?? defaultRunnerMetadataDir(), { recursive: true });
+  await writeFile10(descriptor.metadata.serviceFilePath, descriptor.content, { encoding: "utf8", mode: 384 });
   await writeRunnerServiceMetadata(descriptor.metadata, input.metadataDir);
   if (options.activate !== false) {
     const activation = await activateRunnerService(descriptor.metadata);
@@ -6367,13 +6565,13 @@ async function removeRunnerService(input) {
     return void 0;
   }
   await deactivateRunnerService(metadata).catch(() => void 0);
-  await rm3(metadata.serviceFilePath, { force: true });
-  await rm3(runnerServiceMetadataPath(input, input.metadataDir ?? defaultRunnerMetadataDir()), { force: true });
+  await rm4(metadata.serviceFilePath, { force: true });
+  await rm4(runnerServiceMetadataPath(input, input.metadataDir ?? defaultRunnerMetadataDir()), { force: true });
   return { ...metadata, status: "removed", updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
 }
 async function readRunnerServiceMetadata(input, metadataDir = defaultRunnerMetadataDir()) {
   try {
-    const parsed = JSON.parse(await readFile9(runnerServiceMetadataPath(input, metadataDir), "utf8"));
+    const parsed = JSON.parse(await readFile10(runnerServiceMetadataPath(input, metadataDir), "utf8"));
     if (parsed.schemaVersion !== 1 || !parsed.serviceName || !parsed.serviceFilePath) {
       return void 0;
     }
@@ -6383,8 +6581,8 @@ async function readRunnerServiceMetadata(input, metadataDir = defaultRunnerMetad
   }
 }
 async function writeRunnerServiceMetadata(metadata, metadataDir = defaultRunnerMetadataDir()) {
-  await mkdir9(metadataDir, { recursive: true });
-  await writeFile9(runnerServiceMetadataPath(metadata, metadataDir), JSON.stringify(metadata, null, 2), { encoding: "utf8", mode: 384 });
+  await mkdir10(metadataDir, { recursive: true });
+  await writeFile10(runnerServiceMetadataPath(metadata, metadataDir), JSON.stringify(metadata, null, 2), { encoding: "utf8", mode: 384 });
 }
 async function runnerServiceRuntimeStatus(metadata) {
   if (metadata.platform === "launchd") {
@@ -6467,12 +6665,12 @@ WantedBy=default.target
 }
 function runnerServiceFilePath(platform, serviceName, homeDir) {
   if (platform === "launchd") {
-    return path11.join(homeDir, "Library", "LaunchAgents", `${serviceName}.plist`);
+    return path12.join(homeDir, "Library", "LaunchAgents", `${serviceName}.plist`);
   }
-  return path11.join(homeDir, ".config", "systemd", "user", `${serviceName}.service`);
+  return path12.join(homeDir, ".config", "systemd", "user", `${serviceName}.service`);
 }
 function runnerServiceMetadataPath(input, metadataDir) {
-  return path11.join(metadataDir, `${runnerServiceKey(input)}.service.json`);
+  return path12.join(metadataDir, `${runnerServiceKey(input)}.service.json`);
 }
 function runnerServiceName(input) {
   return `com.amistio.runner.${runnerServiceKey(input).slice(0, 20)}`;
@@ -6807,8 +7005,8 @@ function createSmokeSession({ now, status, lastActivityAt }) {
 // src/sync.ts
 import { execFile as execFile3 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
-import { mkdir as mkdir10, readdir as readdir5, readFile as readFile10, stat as stat4, writeFile as writeFile10 } from "node:fs/promises";
-import path12 from "node:path";
+import { mkdir as mkdir11, readdir as readdir5, readFile as readFile11, stat as stat5, writeFile as writeFile11 } from "node:fs/promises";
+import path13 from "node:path";
 import { promisify as promisify3 } from "node:util";
 var execFileAsync3 = promisify3(execFile3);
 var legacySyncRoots = ["architecture", "context", "decisions", "features", "memory", "plans", "prompts", "workflows"];
@@ -6904,7 +7102,7 @@ async function readLocalSyncedDocuments(rootDir) {
   const documentFiles = await findBrainDocumentFiles(rootDir);
   const documents = [];
   for (const fullPath of documentFiles) {
-    const raw = await readFile10(fullPath, "utf8");
+    const raw = await readFile11(fullPath, "utf8");
     const repoPath = toRepoPath(rootDir, fullPath);
     const parsed = parseSyncedDocument(raw, repoPath);
     if (!parsed) {
@@ -6954,8 +7152,8 @@ async function materializeBrainDocuments(rootDir, documents, options = {}) {
       result.skipped.push(document.repoPath);
       continue;
     }
-    await mkdir10(path12.dirname(fullPath), { recursive: true });
-    await writeFile10(fullPath, createSyncedDocumentContent(document), "utf8");
+    await mkdir11(path13.dirname(fullPath), { recursive: true });
+    await writeFile11(fullPath, createSyncedDocumentContent(document), "utf8");
     result.written.push(document.repoPath);
   }
   return result;
@@ -7084,7 +7282,7 @@ function parseSyncedHtml(content) {
 }
 async function readExistingSyncedDocument(fullPath) {
   try {
-    const raw = await readFile10(fullPath, "utf8");
+    const raw = await readFile11(fullPath, "utf8");
     const parsed = parseSyncedDocument(raw, fullPath);
     if (!parsed) {
       return { exists: true };
@@ -7109,7 +7307,7 @@ async function readExistingSyncedDocument(fullPath) {
 async function findBrainDocumentFiles(rootDir) {
   const files = [];
   for (const syncRoot of [...syncRoots, htmlSyncRoot]) {
-    const fullRoot = path12.join(rootDir, syncRoot);
+    const fullRoot = path13.join(rootDir, syncRoot);
     if (!await exists2(fullRoot)) {
       continue;
     }
@@ -7119,7 +7317,7 @@ async function findBrainDocumentFiles(rootDir) {
 }
 async function walkBrainDocumentFiles(directory, files) {
   for (const entry of await readdir5(directory, { withFileTypes: true })) {
-    const fullPath = path12.join(directory, entry.name);
+    const fullPath = path13.join(directory, entry.name);
     if (entry.isDirectory()) {
       await walkBrainDocumentFiles(fullPath, files);
     } else if (entry.isFile() && /\.(md|mdx|html?)$/i.test(entry.name)) {
@@ -7128,23 +7326,23 @@ async function walkBrainDocumentFiles(directory, files) {
   }
 }
 function safeRepoPath(rootDir, repoPath) {
-  if (path12.isAbsolute(repoPath)) {
+  if (path13.isAbsolute(repoPath)) {
     throw new Error(`Refusing to use absolute repo path: ${repoPath}`);
   }
-  const normalized = path12.normalize(repoPath);
-  if (normalized === ".." || normalized.startsWith(`..${path12.sep}`)) {
+  const normalized = path13.normalize(repoPath);
+  if (normalized === ".." || normalized.startsWith(`..${path13.sep}`)) {
     throw new Error(`Refusing to use path outside the repository: ${repoPath}`);
   }
-  const root = path12.resolve(rootDir);
-  const fullPath = path12.resolve(root, normalized);
-  if (!fullPath.startsWith(`${root}${path12.sep}`)) {
+  const root = path13.resolve(rootDir);
+  const fullPath = path13.resolve(root, normalized);
+  if (!fullPath.startsWith(`${root}${path13.sep}`)) {
     throw new Error(`Refusing to use path outside the repository: ${repoPath}`);
   }
   return fullPath;
 }
 function isControlPlanePath(repoPath) {
-  const normalized = path12.normalize(repoPath);
-  return syncRoots.some((syncRoot) => normalized === syncRoot || normalized.startsWith(`${syncRoot}${path12.sep}`)) || normalized === htmlSyncRoot || normalized.startsWith(`${htmlSyncRoot}${path12.sep}`);
+  const normalized = path13.normalize(repoPath);
+  return syncRoots.some((syncRoot) => normalized === syncRoot || normalized.startsWith(`${syncRoot}${path13.sep}`)) || normalized === htmlSyncRoot || normalized.startsWith(`${htmlSyncRoot}${path13.sep}`);
 }
 function canonicalControlPlaneRepoPath(repoPath) {
   const normalized = repoPath.replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+/, "");
@@ -7155,16 +7353,16 @@ function canonicalControlPlaneRepoPath(repoPath) {
   return normalized;
 }
 function toRepoPath(rootDir, fullPath) {
-  return path12.relative(rootDir, fullPath).split(path12.sep).join("/");
+  return path13.relative(rootDir, fullPath).split(path13.sep).join("/");
 }
 function inferTitle(content, repoPath) {
   const heading = content.split("\n").find((line) => line.startsWith("# "))?.replace(/^#\s+/, "").trim();
   if (heading) return heading;
   const htmlHeading = content.match(/<h1\b[^>]*>([\s\S]*?)<\/h1>/i)?.[1]?.replace(/<[^>]+>/g, "").trim();
-  return htmlHeading || path12.basename(repoPath, path12.extname(repoPath));
+  return htmlHeading || path13.basename(repoPath, path13.extname(repoPath));
 }
 async function collectExternalBrainDocumentsForPush(rootDir, metadata, existingDocuments, options) {
-  const root = path12.resolve(rootDir);
+  const root = path13.resolve(rootDir);
   const maxBytes = (options.maxFileKb ?? defaultAutoSyncMaxFileKb) * 1024;
   const syncedAt = options.syncedAt ?? (/* @__PURE__ */ new Date()).toISOString();
   const existingById = new Map(existingDocuments.map((document) => [document.documentId, document]));
@@ -7180,7 +7378,7 @@ async function collectExternalBrainDocumentsForPush(rootDir, metadata, existingD
       continue;
     }
     const fullPath = safeRepoPath(root, normalizedRepoPath);
-    const fileStat = await stat4(fullPath).catch(() => void 0);
+    const fileStat = await stat5(fullPath).catch(() => void 0);
     if (!fileStat?.isFile()) {
       skipped.push({ repoPath: normalizedRepoPath, reason: "unreadable" });
       continue;
@@ -7189,7 +7387,7 @@ async function collectExternalBrainDocumentsForPush(rootDir, metadata, existingD
       skipped.push({ repoPath: normalizedRepoPath, reason: "tooLarge" });
       continue;
     }
-    const content = await readFile10(fullPath, "utf8").catch(() => void 0);
+    const content = await readFile11(fullPath, "utf8").catch(() => void 0);
     if (content === void 0) {
       skipped.push({ repoPath: normalizedRepoPath, reason: "unreadable" });
       continue;
@@ -7254,7 +7452,7 @@ async function listAutoSyncCandidatePaths(rootDir) {
   }
   const files = [];
   for (const syncRoot of [...syncRoots, htmlSyncRoot, ...legacySyncRoots]) {
-    const fullRoot = path12.join(rootDir, syncRoot);
+    const fullRoot = path13.join(rootDir, syncRoot);
     if (await exists2(fullRoot)) {
       await walkAutoSyncFiles(rootDir, fullRoot, files);
     }
@@ -7263,8 +7461,8 @@ async function listAutoSyncCandidatePaths(rootDir) {
 }
 async function walkAutoSyncFiles(rootDir, directory, files) {
   for (const entry of await readdir5(directory, { withFileTypes: true }).catch(() => [])) {
-    const fullPath = path12.join(directory, entry.name);
-    const repoPath = normalizeRepoPath3(path12.relative(rootDir, fullPath));
+    const fullPath = path13.join(directory, entry.name);
+    const repoPath = normalizeRepoPath3(path13.relative(rootDir, fullPath));
     if (entry.isDirectory()) {
       if (!autoSyncExcludedDirectoryNames.has(entry.name)) {
         await walkAutoSyncFiles(rootDir, fullPath, files);
@@ -7318,7 +7516,7 @@ function parseFrontmatterFromSyncedDocument(frontmatter) {
 }
 async function exists2(filePath) {
   try {
-    await stat4(filePath);
+    await stat5(filePath);
     return true;
   } catch {
     return false;
@@ -7326,9 +7524,9 @@ async function exists2(filePath) {
 }
 
 // src/tool-session-store.ts
-import { mkdir as mkdir11, readFile as readFile11, writeFile as writeFile11 } from "node:fs/promises";
-import os7 from "node:os";
-import path13 from "node:path";
+import { mkdir as mkdir12, readFile as readFile12, writeFile as writeFile12 } from "node:fs/promises";
+import os8 from "node:os";
+import path14 from "node:path";
 var LocalToolSessionStore = class {
   constructor(filePath = defaultSessionStorePath()) {
     this.filePath = filePath;
@@ -7342,12 +7540,12 @@ var LocalToolSessionStore = class {
   async setProviderSessionId(toolSessionId, toolName, providerSessionId) {
     const data = await this.read();
     data[toolSessionId] = { toolName, providerSessionId, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
-    await mkdir11(path13.dirname(this.filePath), { recursive: true });
-    await writeFile11(this.filePath, JSON.stringify(data, null, 2), "utf8");
+    await mkdir12(path14.dirname(this.filePath), { recursive: true });
+    await writeFile12(this.filePath, JSON.stringify(data, null, 2), "utf8");
   }
   async read() {
     try {
-      return JSON.parse(await readFile11(this.filePath, "utf8"));
+      return JSON.parse(await readFile12(this.filePath, "utf8"));
     } catch {
       return {};
     }
@@ -7355,16 +7553,16 @@ var LocalToolSessionStore = class {
 };
 function defaultSessionStorePath() {
   if (process.platform === "darwin") {
-    return path13.join(os7.homedir(), "Library", "Application Support", "Amistio", "tool-sessions.json");
+    return path14.join(os8.homedir(), "Library", "Application Support", "Amistio", "tool-sessions.json");
   }
   if (process.platform === "win32") {
-    return path13.join(process.env.APPDATA ?? os7.homedir(), "Amistio", "tool-sessions.json");
+    return path14.join(process.env.APPDATA ?? os8.homedir(), "Amistio", "tool-sessions.json");
   }
-  return path13.join(process.env.XDG_STATE_HOME ?? path13.join(os7.homedir(), ".local", "state"), "amistio", "tool-sessions.json");
+  return path14.join(process.env.XDG_STATE_HOME ?? path14.join(os8.homedir(), ".local", "state"), "amistio", "tool-sessions.json");
 }
 
 // src/work-runner.ts
-import path14 from "node:path";
+import path15 from "node:path";
 var generationResultStart = "AMISTIO_BRAIN_GENERATION_RESULT_START";
 var generationResultEnd = "AMISTIO_BRAIN_GENERATION_RESULT_END";
 var assistantAnswerStart = "AMISTIO_ASSISTANT_ANSWER_START";
@@ -8958,15 +9156,15 @@ function normalizeProjectContextRepoPath(value, options) {
   if (!trimmed || /^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(trimmed) || /^file:/i.test(trimmed) || /^[A-Za-z]:($|[^\\/])/.test(trimmed)) {
     throwUnsafeProjectContextPath();
   }
-  const absolute = trimmed.startsWith("/") || trimmed.startsWith("\\\\") || path14.isAbsolute(trimmed) || path14.win32.isAbsolute(trimmed);
+  const absolute = trimmed.startsWith("/") || trimmed.startsWith("\\\\") || path15.isAbsolute(trimmed) || path15.win32.isAbsolute(trimmed);
   if (!absolute) {
     return normalizeRelativeProjectContextPath(trimmed);
   }
   if (!options.repositoryRoot) {
     throwUnsafeProjectContextPath();
   }
-  const useWindowsPathRules = path14.win32.isAbsolute(trimmed) && !trimmed.startsWith("/");
-  const relativePath = useWindowsPathRules ? path14.win32.relative(path14.win32.resolve(options.repositoryRoot), path14.win32.resolve(trimmed)) : path14.relative(path14.resolve(options.repositoryRoot), path14.resolve(trimmed));
+  const useWindowsPathRules = path15.win32.isAbsolute(trimmed) && !trimmed.startsWith("/");
+  const relativePath = useWindowsPathRules ? path15.win32.relative(path15.win32.resolve(options.repositoryRoot), path15.win32.resolve(trimmed)) : path15.relative(path15.resolve(options.repositoryRoot), path15.resolve(trimmed));
   return normalizeRelativeProjectContextPath(relativePath);
 }
 function normalizeRelativeProjectContextPath(value) {
@@ -9050,15 +9248,15 @@ function stripJsonFence(value) {
 }
 
 // src/runner-resources.ts
-import os8 from "node:os";
+import os9 from "node:os";
 var defaultRuntime = {
   nowMs: () => Date.now(),
   memoryUsage: () => process.memoryUsage(),
   uptime: () => process.uptime(),
   cpuUsage: () => process.cpuUsage(),
-  totalmem: () => os8.totalmem(),
-  freemem: () => os8.freemem(),
-  loadavg: () => os8.loadavg()
+  totalmem: () => os9.totalmem(),
+  freemem: () => os9.freemem(),
+  loadavg: () => os9.loadavg()
 };
 var previousRunnerResourceSample;
 function sampleCurrentRunnerResourceUsage() {
@@ -9171,8 +9369,8 @@ function roundNumber(value, digits) {
 // src/importer.ts
 import { execFile as execFile4 } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
-import { readdir as readdir6, readFile as readFile12, stat as stat5 } from "node:fs/promises";
-import path15 from "node:path";
+import { readdir as readdir6, readFile as readFile13, stat as stat6 } from "node:fs/promises";
+import path16 from "node:path";
 import { promisify as promisify4 } from "node:util";
 var execFileAsync4 = promisify4(execFile4);
 var defaultMaxFileKb = 256;
@@ -9193,12 +9391,12 @@ var documentFolderByType = {
   workflow: "docs/workflows"
 };
 async function inspectLocalRepository(rootDir, defaultBranch) {
-  const requestedRoot = path15.resolve(rootDir);
+  const requestedRoot = path16.resolve(rootDir);
   const root = await runGit2(["-C", requestedRoot, "rev-parse", "--show-toplevel"]).catch(() => requestedRoot);
   const detectedBranch = await runGit2(["-C", root, "symbolic-ref", "--quiet", "--short", "HEAD"]).catch(() => defaultBranch);
   const originUrl = await runGit2(["-C", root, "remote", "get-url", "origin"]).catch(() => void 0);
   const parsedCloneUrl = originUrl ? parseOptionalOriginCloneUrl(originUrl) : void 0;
-  const repoName = (parsedCloneUrl?.repoName ?? path15.basename(root)) || "repository";
+  const repoName = (parsedCloneUrl?.repoName ?? path16.basename(root)) || "repository";
   const fingerprintSeed = parsedCloneUrl ? `origin:${parsedCloneUrl.normalizedKey}` : `repo:${repoName}:${detectedBranch || defaultBranch}`;
   return {
     rootDir: root,
@@ -9210,7 +9408,7 @@ async function inspectLocalRepository(rootDir, defaultBranch) {
   };
 }
 async function scanLegacyDocuments(options) {
-  const rootDir = path15.resolve(options.rootDir);
+  const rootDir = path16.resolve(options.rootDir);
   const maxBytes = (options.maxFileKb ?? defaultMaxFileKb) * 1024;
   const skipped = [];
   const candidates = [];
@@ -9230,8 +9428,8 @@ async function scanLegacyDocuments(options) {
       skipped.push({ repoPath, reason: "excluded" });
       continue;
     }
-    const fullPath = path15.join(rootDir, ...repoPath.split("/"));
-    const fileStat = await stat5(fullPath).catch(() => void 0);
+    const fullPath = path16.join(rootDir, ...repoPath.split("/"));
+    const fileStat = await stat6(fullPath).catch(() => void 0);
     if (!fileStat?.isFile()) {
       skipped.push({ repoPath, reason: "unreadable" });
       continue;
@@ -9240,7 +9438,7 @@ async function scanLegacyDocuments(options) {
       skipped.push({ repoPath, reason: "tooLarge" });
       continue;
     }
-    const content = await readFile12(fullPath, "utf8").catch(() => void 0);
+    const content = await readFile13(fullPath, "utf8").catch(() => void 0);
     if (content === void 0) {
       skipped.push({ repoPath, reason: "unreadable" });
       continue;
@@ -9332,8 +9530,8 @@ async function listRepositoryPaths(rootDir) {
 async function walkRepository(rootDir, directory, files) {
   const entries = await readdir6(directory, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
-    const fullPath = path15.join(directory, entry.name);
-    const repoPath = normalizeRepoPath4(path15.relative(rootDir, fullPath));
+    const fullPath = path16.join(directory, entry.name);
+    const repoPath = normalizeRepoPath4(path16.relative(rootDir, fullPath));
     if (entry.isDirectory()) {
       if (!excludedDirectoryNames.has(entry.name)) {
         await walkRepository(rootDir, fullPath, files);
@@ -9401,9 +9599,9 @@ function uniqueDestinationPath(basePath, sourcePath, usedPaths) {
     usedPaths.add(basePath);
     return basePath;
   }
-  const extension = path15.posix.extname(basePath) || ".md";
-  const directory = path15.posix.dirname(basePath);
-  const basename = path15.posix.basename(basePath, extension);
+  const extension = path16.posix.extname(basePath) || ".md";
+  const directory = path16.posix.dirname(basePath);
+  const basename = path16.posix.basename(basePath, extension);
   const uniquePath = `${directory}/${basename}-${hashText(sourcePath, 8)}${extension}`;
   usedPaths.add(uniquePath);
   return uniquePath;
@@ -9476,7 +9674,7 @@ function inferTitle2(content, repoPath) {
   if (heading) return heading;
   const htmlHeading = body.match(/<h1\b[^>]*>([\s\S]*?)<\/h1>/i)?.[1]?.replace(/<[^>]+>/g, "").trim();
   if (htmlHeading) return htmlHeading;
-  const basename = path15.posix.basename(repoPath, path15.posix.extname(repoPath)).replace(/[-_]+/g, " ").trim();
+  const basename = path16.posix.basename(repoPath, path16.posix.extname(repoPath)).replace(/[-_]+/g, " ").trim();
   return titleCase(basename || "Imported Document");
 }
 function stripFrontmatter(content) {
@@ -9517,7 +9715,7 @@ async function runGit2(args) {
 
 // src/runner-actions.ts
 import { spawn as spawn4 } from "node:child_process";
-import path16 from "node:path";
+import path17 from "node:path";
 function buildBackgroundRunnerArgs(options) {
   const args = [
     "run",
@@ -9527,7 +9725,7 @@ function buildBackgroundRunnerArgs(options) {
     "--runner-id",
     options.runnerId,
     "--root",
-    path16.resolve(options.root),
+    path17.resolve(options.root),
     "--session",
     options.session,
     "--interval-seconds",
@@ -9651,8 +9849,8 @@ function truncateProcessOutput(value) {
 
 // src/git-worktree.ts
 import { execFile as execFile5 } from "node:child_process";
-import { copyFile, lstat, mkdir as mkdir12, readdir as readdir7, stat as stat6 } from "node:fs/promises";
-import path17 from "node:path";
+import { copyFile, lstat, mkdir as mkdir13, readdir as readdir7, stat as stat7 } from "node:fs/promises";
+import path18 from "node:path";
 import { promisify as promisify5 } from "node:util";
 var execFileAsync5 = promisify5(execFile5);
 var exactLocalEnvironmentFiles = /* @__PURE__ */ new Set([".env", ".env.local", ".env.development", ".env.development.local", ".env.test", ".env.test.local", ".env.production", ".env.production.local"]);
@@ -9687,7 +9885,7 @@ async function prepareGitWorktreeIsolation(rootDir, workItem) {
     return { ...identity, baseRevision, worktreePath, ...preparedLocalEnvironmentFileCount2 ? { preparedLocalEnvironmentFileCount: preparedLocalEnvironmentFileCount2 } : {} };
   }
   await repairMissingRegisteredWorktree(repoRoot, worktreePath, identity.branch, identity.worktreeKey);
-  await mkdir12(path17.dirname(worktreePath), { recursive: true });
+  await mkdir13(path18.dirname(worktreePath), { recursive: true });
   const branchExists = await gitCommandSucceeds(repoRoot, ["show-ref", "--verify", "--quiet", `refs/heads/${identity.branch}`]);
   const worktreeArgs = branchExists ? ["worktree", "add", worktreePath, identity.branch] : ["worktree", "add", "-b", identity.branch, worktreePath, baseRevision];
   await gitOutput(repoRoot, worktreeArgs).catch((error) => {
@@ -9705,9 +9903,9 @@ async function resolveExistingGitWorktreeIsolation(rootDir, workItem) {
   return { ...identity, baseRevision, worktreePath };
 }
 function localWorktreePath(repoRoot, worktreeKey) {
-  const repoName = path17.basename(repoRoot);
+  const repoName = path18.basename(repoRoot);
   const worktreeSlug = worktreeKey.split("/").filter(Boolean).pop() ?? "work";
-  return path17.join(path17.dirname(repoRoot), `${repoName}.worktrees`, worktreeSlug);
+  return path18.join(path18.dirname(repoRoot), `${repoName}.worktrees`, worktreeSlug);
 }
 async function assertExistingWorktree(worktreePath, branch) {
   await gitOutput(worktreePath, ["rev-parse", "--is-inside-work-tree"]);
@@ -9770,7 +9968,7 @@ function parseRegisteredGitWorktrees(output) {
   return worktrees;
 }
 function normalizeGitWorktreePath(value) {
-  const resolved = path17.resolve(value);
+  const resolved = path18.resolve(value);
   return resolved.startsWith("/private/var/") ? resolved.replace("/private/var/", "/var/") : resolved;
 }
 async function assertBaseRevision(repoRoot, baseRevision, currentHead) {
@@ -9790,8 +9988,8 @@ async function prepareLocalWorktreeEnvironment(repoRoot, worktreePath) {
   const candidates = await localEnvironmentFileCandidates(repoRoot);
   let preparedCount = 0;
   for (const candidate of candidates) {
-    const sourcePath = path17.join(repoRoot, candidate);
-    const targetPath = path17.join(worktreePath, candidate);
+    const sourcePath = path18.join(repoRoot, candidate);
+    const targetPath = path18.join(worktreePath, candidate);
     if (await pathExists(targetPath)) {
       continue;
     }
@@ -9822,7 +10020,7 @@ async function localEnvironmentFileCandidates(repoRoot) {
     if (!isRootFileName(name)) {
       continue;
     }
-    const source = await lstat(path17.join(repoRoot, name)).catch(() => void 0);
+    const source = await lstat(path18.join(repoRoot, name)).catch(() => void 0);
     if (source?.isFile()) {
       candidates.push(name);
     }
@@ -9833,7 +10031,7 @@ function isAllowedLocalEnvironmentFile(name) {
   return exactLocalEnvironmentFiles.has(name) || localEnvironmentFilePattern.test(name);
 }
 function isRootFileName(name) {
-  return name === path17.basename(name) && !name.includes("/") && !name.includes("\\");
+  return name === path18.basename(name) && !name.includes("/") && !name.includes("\\");
 }
 async function gitOutput(cwd, args) {
   const { stdout } = await execFileAsync5("git", args, { cwd, maxBuffer: 1024 * 1024 });
@@ -9843,7 +10041,7 @@ async function gitCommandSucceeds(cwd, args) {
   return execFileAsync5("git", args, { cwd }).then(() => true, () => false);
 }
 async function pathExists(value) {
-  return stat6(value).then(() => true, () => false);
+  return stat7(value).then(() => true, () => false);
 }
 function workIsolationSlug(scopeId, title) {
   const scopeSlug = slugify(scopeId);
@@ -9866,7 +10064,7 @@ function safeFileError(error) {
 
 // src/implementation-handoff.ts
 import { execFile as execFile6 } from "node:child_process";
-import path18 from "node:path";
+import path19 from "node:path";
 import { promisify as promisify6 } from "node:util";
 var execFileAsync6 = promisify6(execFile6);
 var DEFAULT_IMPLEMENTATION_EXPECTED_OUTCOME = "sourceImplementation";
@@ -10320,7 +10518,7 @@ async function cleanupWorktree(run, input) {
     return { status: "failed", message: "Cleanup skipped because the worktree is not clean after PR handoff." };
   }
   try {
-    await gitOutput2(run, input.primaryRepoRoot || path18.dirname(input.worktreePath), ["worktree", "remove", input.worktreePath]);
+    await gitOutput2(run, input.primaryRepoRoot || path19.dirname(input.worktreePath), ["worktree", "remove", input.worktreePath]);
     return { status: "completed" };
   } catch (error) {
     return { status: "failed", message: `Cleanup failed: ${safeErrorMessage(error)}` };
@@ -11138,7 +11336,7 @@ program.command("import").description("Pair an existing checkout and import lega
 });
 program.command("pair").description("Pair this repository with an Amistio web project").requiredOption("--account <accountId>", "Amistio account ID").requiredOption("--project <projectId>", "Amistio project ID").option("--repository-link <repositoryLinkId>", "Existing repository link ID").option("--default-branch <branch>", "Default branch", "main").option("--api-url <url>", apiUrlOptionDescription, defaultApiUrl()).option("--pairing-code <code>", "Short-lived pairing code from the Amistio app").option("--token <token>", "Runner/device credential to store outside the repository").option("--root <path>", "Repository root", defaultRoot).action(async (options, command) => {
   const pairingRoot = await resolvePairingRoot(options.root, { explicitRoot: command.getOptionValueSource("root") === "cli" });
-  let repositoryLinkId = options.repositoryLink ?? `repo_${randomUUID3()}`;
+  let repositoryLinkId = options.repositoryLink ?? `repo_${randomUUID4()}`;
   let credential = options.token;
   if (options.pairingCode) {
     const pairing = await new ApiClient({
@@ -11279,7 +11477,7 @@ sync.command("watch").description("Watch repository brain folders and auto-sync
       console.log(`Auto-sync watcher stopped after ${iterations} polling attempt${iterations === 1 ? "" : "s"}.`);
       return;
     }
-    await delay(options.intervalSeconds * 1e3);
+    await delay2(options.intervalSeconds * 1e3);
   }
 });
 var work = program.command("work").description("Inspect approved work items");
@@ -11324,7 +11522,7 @@ work.command("prompt").description("Print or write an approved work prompt witho
   }
   const prompt = await createRunnerWorkPrompt(context.client, context.metadata.amistioProjectId, workItem);
   if (options.out) {
-    await writeFile12(options.out, prompt, "utf8");
+    await writeFile13(options.out, prompt, "utf8");
     console.log(`Wrote work prompt to ${options.out}.`);
   } else {
     console.log(prompt);
@@ -11434,7 +11632,7 @@ program.command("orchestrate").description("Update the Amistio control plane thr
     ...options.toolCommand ? { toolCommand: options.toolCommand } : {},
     ...localModelConfig,
     streamOutput: options.stream,
-    ...sessionPolicy === "none" ? {} : { session: { toolSessionId: `local_orchestration_${randomUUID3()}`, policy: sessionPolicy, decision: localSessionDecision(sessionPolicy) } }
+    ...sessionPolicy === "none" ? {} : { session: { toolSessionId: `local_orchestration_${randomUUID4()}`, policy: sessionPolicy, decision: localSessionDecision(sessionPolicy) } }
   });
   if (!options.stream && result.stdout.trim()) {
     console.log(result.stdout.trim());
@@ -11475,7 +11673,7 @@ program.command("run").description("Claim and run approved Amistio work locally"
       projectId: context.metadata.amistioProjectId,
       repositoryLinkId: context.metadata.repositoryLinkId,
       runnerId,
-      rootDir: path19.resolve(options.root),
+      rootDir: path20.resolve(options.root),
       apiUrl: options.apiUrl,
       args: buildBackgroundRunnerArgs(resolvedOptions)
     });
@@ -11545,7 +11743,7 @@ program.command("run").description("Claim and run approved Amistio work locally"
         console.log(`Runner stopped after ${iterations} polling attempt${iterations === 1 ? "" : "s"}.`);
         return;
       }
-      await delay(options.intervalSeconds * 1e3);
+      await delay2(options.intervalSeconds * 1e3);
     }
   } finally {
     process.off("SIGINT", handleShutdownSignal);
@@ -11704,7 +11902,7 @@ runnerService.command("install").description("Install a user-level startup servi
     projectId: context.metadata.amistioProjectId,
     repositoryLinkId: context.metadata.repositoryLinkId,
     runnerId,
-    rootDir: path19.resolve(options.root),
+    rootDir: path20.resolve(options.root),
     apiUrl: options.apiUrl,
     args,
     platform
@@ -11993,612 +12191,696 @@ async function runNextWorkItem({
     }
     return { status: "idle", exitCode: 0, nextAction, message };
   }
-  const prompt = await createRunnerWorkPrompt(apiClient, projectId, result.workItem);
-  await recordRunnerMilestone(apiClient, projectId, result.workItem, runnerId, repositoryLinkId, {
-    status: "running",
-    summary: "Prepared local runner execution prompt.",
-    idempotencyKey: `runner_milestone_prompt_${result.workItem.workItemId}_${result.workItem.attempt}`,
-    metadata: { workKind: result.workItem.workKind ?? "implementation", attempt: result.workItem.attempt }
-  });
-  if (dryRun || toolConfig.tool === "none") {
-    console.log(prompt);
-    await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig, currentRunnerMode(), heartbeatConcurrency));
-    return { status: "preview", exitCode: 0 };
-  }
-  const worktreeIsolation = await prepareWorktreeForClaimedItem({ apiClient, heartbeatConcurrency, maxPreflightAttempts, projectId, repositoryLinkId, root, runnerId, toolConfig, workItem: result.workItem });
-  if (worktreeIsolation.status !== "ready") {
-    return { status: worktreeIsolation.status === "failed" ? "failed" : "blocked", exitCode: 1, message: worktreeIsolation.message };
-  }
-  const executionRoot = worktreeIsolation.isolation?.worktreePath ?? root;
-  const isolationTelemetry = workItemIsolationTelemetry(result.workItem, worktreeIsolation.isolation);
-  const environmentReadiness = await checkRunnerExecutionEnvironment({
-    executionRoot,
-    primaryCheckoutRoot: root,
-    profile: executionProfile,
-    setupCommands: runnerEnvironmentSetupCommands(setupPackageManagerInstall),
-    ...result.workItem.workKind ? { workKind: result.workItem.workKind } : {},
-    env: process.env
-  });
-  if (environmentReadiness.profile === "dockerWorkspace" && environmentReadiness.status === "ready") {
-    environmentReadiness.status = "blocked";
-    environmentReadiness.summary = "Runner execution environment dockerWorkspace is blocked: containerized harness execution is not enabled in this runner build.";
-    environmentReadiness.blockers.push({ reason: "unsupportedProfile", summary: "Containerized harness execution is not enabled in this runner build.", remediation: "Select hostWorktree or hostWorktreeWithSetup until Docker workspace execution is enabled.", safePaths: [] });
-    environmentReadiness.checks.push({ checkId: "docker-harness", title: "Docker harness", status: "blocked", reason: "unsupportedProfile", summary: "Docker workspace envelope is valid, but this runner cannot execute the harness inside the container yet.", safePaths: [] });
-  }
-  if (environmentReadiness.status === "blocked") {
-    const statusResult2 = await apiClient.updateWorkStatus(projectId, result.workItem.workItemId, "blocked", `environment_blocked_${result.workItem.workItemId}_${result.workItem.attempt}_${randomUUID3()}`, runnerId, {
-      ...isolationTelemetry,
-      executionEnvironmentProfile: environmentReadiness.profile,
-      executionEnvironmentReadiness: environmentReadiness,
-      blockerReason: environmentReadiness.summary,
-      message: environmentReadiness.summary
+  const localActiveClaim = await defaultRunnerActiveClaimStore.reserve(runnerActiveClaimInput({
+    accountId: commandContext.accountId,
+    claimLaneId,
+    repositoryLinkId,
+    runnerId,
+    toolTimeoutMs,
+    workItem: result.workItem
+  }));
+  if (localActiveClaim.status === "blocked") {
+    return await releaseSkippedLocalClaim({
+      apiClient,
+      claimLaneId,
+      conflict: localActiveClaim,
+      projectId,
+      repositoryLinkId,
+      runnerId,
+      workItem: result.workItem
     });
-    await recordRunnerMilestone(apiClient, projectId, statusResult2.workItem, runnerId, repositoryLinkId, {
-      status: "warning",
-      summary: environmentReadiness.summary,
-      idempotencyKey: `runner_milestone_environment_blocked_${result.workItem.workItemId}_${statusResult2.workItem.idempotencyKey}`,
-      metadata: { executionEnvironmentProfile: environmentReadiness.profile, blockerReasons: environmentReadiness.blockers.map((blocker) => blocker.reason) }
+  }
+  const releaseLocalActiveClaim = async () => {
+    await defaultRunnerActiveClaimStore.release(localActiveClaim.record.reservationId).catch((error) => {
+      console.error(`Could not release local Amistio active-claim reservation for ${result.workItem?.workItemId}: ${truncateLogExcerpt(errorDetail(error))}`);
     });
-    await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "blocked", {
-      ...runnerHeartbeatMetadata(toolConfig, currentRunnerMode(), heartbeatConcurrency),
-      currentWorkItemId: result.workItem.workItemId,
-      currentExecutionEnvironmentProfile: environmentReadiness.profile,
-      environmentReadiness,
-      preferenceMessage: environmentReadiness.summary,
-      ...isolationTelemetry.implementationScopeId ? { currentImplementationScopeId: isolationTelemetry.implementationScopeId } : {},
-      ...isolationTelemetry.executionWorktreeKey ? { currentWorktreeKey: isolationTelemetry.executionWorktreeKey } : {},
-      ...isolationTelemetry.executionBranch ? { currentBranch: isolationTelemetry.executionBranch } : {}
+  };
+  try {
+    const prompt = await createRunnerWorkPrompt(apiClient, projectId, result.workItem);
+    await recordRunnerMilestone(apiClient, projectId, result.workItem, runnerId, repositoryLinkId, {
+      status: "running",
+      summary: "Prepared local runner execution prompt.",
+      idempotencyKey: `runner_milestone_prompt_${result.workItem.workItemId}_${result.workItem.attempt}`,
+      metadata: { workKind: result.workItem.workKind ?? "implementation", attempt: result.workItem.attempt }
     });
-    console.error(environmentReadiness.summary);
-    return { status: "blocked", exitCode: 1, message: environmentReadiness.summary };
-  }
-  await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "running", {
-    ...runnerHeartbeatMetadata(toolConfig, currentRunnerMode(), heartbeatConcurrency),
-    currentWorkItemId: result.workItem.workItemId,
-    currentExecutionEnvironmentProfile: environmentReadiness.profile,
-    environmentReadiness,
-    ...isolationTelemetry.implementationScopeId ? { currentImplementationScopeId: isolationTelemetry.implementationScopeId } : {},
-    ...isolationTelemetry.executionWorktreeKey ? { currentWorktreeKey: isolationTelemetry.executionWorktreeKey } : {},
-    ...isolationTelemetry.executionBranch ? { currentBranch: isolationTelemetry.executionBranch } : {}
-  });
-  if (isImplementationHandoffWork(result.workItem)) {
-    const repositoryLink = await loadWorkItemRepositoryLink(apiClient, projectId, result.workItem.repositoryLinkId ?? repositoryLinkId).catch(() => void 0);
-    const readinessHandoff = await checkImplementationHandoffReadiness({
-      primaryRepoRoot: root,
-      ...repositoryLink ? { repositoryLink } : {},
-      workItem: result.workItem,
-      ...worktreeIsolation.isolation ? { worktreeIsolation: worktreeIsolation.isolation } : {},
-      worktreePath: executionRoot
+    if (dryRun || toolConfig.tool === "none") {
+      console.log(prompt);
+      await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig, currentRunnerMode(), heartbeatConcurrency));
+      return { status: "preview", exitCode: 0 };
+    }
+    const worktreeIsolation = await prepareWorktreeForClaimedItem({ apiClient, heartbeatConcurrency, maxPreflightAttempts, projectId, repositoryLinkId, root, runnerId, toolConfig, workItem: result.workItem });
+    if (worktreeIsolation.status !== "ready") {
+      return { status: worktreeIsolation.status === "failed" ? "failed" : "blocked", exitCode: 1, message: worktreeIsolation.message };
+    }
+    const executionRoot = worktreeIsolation.isolation?.worktreePath ?? root;
+    const isolationTelemetry = workItemIsolationTelemetry(result.workItem, worktreeIsolation.isolation);
+    const environmentReadiness = await checkRunnerExecutionEnvironment({
+      executionRoot,
+      primaryCheckoutRoot: root,
+      profile: executionProfile,
+      setupCommands: runnerEnvironmentSetupCommands(setupPackageManagerInstall),
+      ...result.workItem.workKind ? { workKind: result.workItem.workKind } : {},
+      env: process.env
     });
-    if (readinessHandoff) {
-      const message = readinessHandoff.message ?? "Implementation handoff readiness is blocked before local tool execution.";
-      const statusResult2 = await apiClient.updateWorkStatus(projectId, result.workItem.workItemId, "blocked", `handoff_readiness_blocked_${result.workItem.workItemId}_${result.workItem.attempt}_${randomUUID3()}`, runnerId, {
+    if (environmentReadiness.profile === "dockerWorkspace" && environmentReadiness.status === "ready") {
+      environmentReadiness.status = "blocked";
+      environmentReadiness.summary = "Runner execution environment dockerWorkspace is blocked: containerized harness execution is not enabled in this runner build.";
+      environmentReadiness.blockers.push({ reason: "unsupportedProfile", summary: "Containerized harness execution is not enabled in this runner build.", remediation: "Select hostWorktree or hostWorktreeWithSetup until Docker workspace execution is enabled.", safePaths: [] });
+      environmentReadiness.checks.push({ checkId: "docker-harness", title: "Docker harness", status: "blocked", reason: "unsupportedProfile", summary: "Docker workspace envelope is valid, but this runner cannot execute the harness inside the container yet.", safePaths: [] });
+    }
+    if (environmentReadiness.status === "blocked") {
+      const statusResult2 = await apiClient.updateWorkStatus(projectId, result.workItem.workItemId, "blocked", `environment_blocked_${result.workItem.workItemId}_${result.workItem.attempt}_${randomUUID4()}`, runnerId, {
         ...isolationTelemetry,
-        implementationHandoff: readinessHandoff,
-        blockerReason: message,
-        message,
-        ...readinessHandoff.error ? { error: readinessHandoff.error } : {}
+        executionEnvironmentProfile: environmentReadiness.profile,
+        executionEnvironmentReadiness: environmentReadiness,
+        blockerReason: environmentReadiness.summary,
+        message: environmentReadiness.summary
       });
       await recordRunnerMilestone(apiClient, projectId, statusResult2.workItem, runnerId, repositoryLinkId, {
-        status: "blocked",
-        summary: message,
-        idempotencyKey: `runner_milestone_handoff_readiness_blocked_${result.workItem.workItemId}_${statusResult2.workItem.idempotencyKey}`,
-        metadata: {
-          recoveryCategory: readinessHandoff.recovery?.category ?? "providerBlocked",
-          executionWorktreeKey: isolationTelemetry.executionWorktreeKey ?? "",
-          executionBranch: isolationTelemetry.executionBranch ?? ""
-        }
+        status: "warning",
+        summary: environmentReadiness.summary,
+        idempotencyKey: `runner_milestone_environment_blocked_${result.workItem.workItemId}_${statusResult2.workItem.idempotencyKey}`,
+        metadata: { executionEnvironmentProfile: environmentReadiness.profile, blockerReasons: environmentReadiness.blockers.map((blocker) => blocker.reason) }
       });
       await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "blocked", {
         ...runnerHeartbeatMetadata(toolConfig, currentRunnerMode(), heartbeatConcurrency),
         currentWorkItemId: result.workItem.workItemId,
-        preferenceMessage: message,
+        currentExecutionEnvironmentProfile: environmentReadiness.profile,
+        environmentReadiness,
+        preferenceMessage: environmentReadiness.summary,
         ...isolationTelemetry.implementationScopeId ? { currentImplementationScopeId: isolationTelemetry.implementationScopeId } : {},
         ...isolationTelemetry.executionWorktreeKey ? { currentWorktreeKey: isolationTelemetry.executionWorktreeKey } : {},
         ...isolationTelemetry.executionBranch ? { currentBranch: isolationTelemetry.executionBranch } : {}
       });
-      console.error(message);
-      return { status: "blocked", exitCode: 1, message };
-    }
-  }
-  const resolvedModelConfig = toolConfigModelOptions(toolConfig);
-  const preparedHarnessRun = await builtinAmistioHarnessAdapter.createRunPreview({
-    rootDir: executionRoot,
-    prompt,
-    tool: toolConfig.tool,
-    invocationChannel: toolConfig.requestedInvocationChannel ?? "auto",
-    ...toolCommand ? { toolCommand } : {},
-    ...resolvedModelConfig,
-    executionPolicy: {
-      executionRoot,
-      mutationPolicy: harnessMutationPolicyForWorkItem(result.workItem),
-      claimLaneId
+      console.error(environmentReadiness.summary);
+      return { status: "blocked", exitCode: 1, message: environmentReadiness.summary };
     }
-  });
-  const preview = preparedHarnessRun.preview;
-  const sessionContext = await prepareToolSession({
-    apiClient,
-    projectId,
-    repositoryLinkId,
-    runnerId,
-    machineId: runnerMachineId(),
-    sessionPolicy: result.workItem.sessionPolicy ?? sessionPolicy,
-    toolName: preview.toolName,
-    ...toolConfig.model ? { model: toolConfig.model } : {},
-    supportsSessionReuse: preview.supportsSessionReuse,
-    resumabilityScope: preview.resumabilityScope,
-    workItem: result.workItem,
-    isolationTelemetry
-  });
-  console.log(`Claimed ${result.workItem.workItemId}. Running ${preview.toolName}: ${preview.displayCommand}`);
-  const autopilotClaimLine = formatAutopilotClaimLine(result.workItem);
-  if (autopilotClaimLine) {
-    console.log(autopilotClaimLine);
-  }
-  const promptBatchClaimLine = formatPromptBatchClaimLine(result.workItem);
-  if (promptBatchClaimLine) {
-    console.log(promptBatchClaimLine);
-  }
-  await recordRunnerMilestone(apiClient, projectId, result.workItem, runnerId, repositoryLinkId, {
-    status: "running",
-    summary: `Local runner started ${preview.toolName} execution.`,
-    idempotencyKey: `runner_milestone_started_${result.workItem.workItemId}_${result.workItem.attempt}`,
-    metadata: {
-      tool: preview.toolName,
-      invocationChannel: toolConfig.requestedInvocationChannel ?? "auto",
-      claimLaneId: preparedHarnessRun.concurrency.claimLaneId,
-      harnessSupportsConcurrentRuns: preparedHarnessRun.concurrency.supportsConcurrentRuns,
-      harnessRequiresExclusiveRepository: preparedHarnessRun.concurrency.requiresExclusiveRepository,
-      harnessRequiresExclusiveProviderAuth: preparedHarnessRun.concurrency.requiresExclusiveProviderAuth,
-      harnessSerializedResourceKeys: preparedHarnessRun.concurrency.serializedResourceKeys
+    await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "running", {
+      ...runnerHeartbeatMetadata(toolConfig, currentRunnerMode(), heartbeatConcurrency),
+      currentWorkItemId: result.workItem.workItemId,
+      currentExecutionEnvironmentProfile: environmentReadiness.profile,
+      environmentReadiness,
+      ...isolationTelemetry.implementationScopeId ? { currentImplementationScopeId: isolationTelemetry.implementationScopeId } : {},
+      ...isolationTelemetry.executionWorktreeKey ? { currentWorktreeKey: isolationTelemetry.executionWorktreeKey } : {},
+      ...isolationTelemetry.executionBranch ? { currentBranch: isolationTelemetry.executionBranch } : {}
+    });
+    if (isImplementationHandoffWork(result.workItem)) {
+      const repositoryLink = await loadWorkItemRepositoryLink(apiClient, projectId, result.workItem.repositoryLinkId ?? repositoryLinkId).catch(() => void 0);
+      const readinessHandoff = await checkImplementationHandoffReadiness({
+        primaryRepoRoot: root,
+        ...repositoryLink ? { repositoryLink } : {},
+        workItem: result.workItem,
+        ...worktreeIsolation.isolation ? { worktreeIsolation: worktreeIsolation.isolation } : {},
+        worktreePath: executionRoot
+      });
+      if (readinessHandoff) {
+        const message = readinessHandoff.message ?? "Implementation handoff readiness is blocked before local tool execution.";
+        const statusResult2 = await apiClient.updateWorkStatus(projectId, result.workItem.workItemId, "blocked", `handoff_readiness_blocked_${result.workItem.workItemId}_${result.workItem.attempt}_${randomUUID4()}`, runnerId, {
+          ...isolationTelemetry,
+          implementationHandoff: readinessHandoff,
+          blockerReason: message,
+          message,
+          ...readinessHandoff.error ? { error: readinessHandoff.error } : {}
+        });
+        await recordRunnerMilestone(apiClient, projectId, statusResult2.workItem, runnerId, repositoryLinkId, {
+          status: "blocked",
+          summary: message,
+          idempotencyKey: `runner_milestone_handoff_readiness_blocked_${result.workItem.workItemId}_${statusResult2.workItem.idempotencyKey}`,
+          metadata: {
+            recoveryCategory: readinessHandoff.recovery?.category ?? "providerBlocked",
+            executionWorktreeKey: isolationTelemetry.executionWorktreeKey ?? "",
+            executionBranch: isolationTelemetry.executionBranch ?? ""
+          }
+        });
+        await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "blocked", {
+          ...runnerHeartbeatMetadata(toolConfig, currentRunnerMode(), heartbeatConcurrency),
+          currentWorkItemId: result.workItem.workItemId,
+          preferenceMessage: message,
+          ...isolationTelemetry.implementationScopeId ? { currentImplementationScopeId: isolationTelemetry.implementationScopeId } : {},
+          ...isolationTelemetry.executionWorktreeKey ? { currentWorktreeKey: isolationTelemetry.executionWorktreeKey } : {},
+          ...isolationTelemetry.executionBranch ? { currentBranch: isolationTelemetry.executionBranch } : {}
+        });
+        console.error(message);
+        return { status: "blocked", exitCode: 1, message };
+      }
     }
-  });
-  const startedAt = Date.now();
-  const providerSessionStore = new LocalToolSessionStore();
-  const providerSessionId = sessionContext.toolSession ? await providerSessionStore.getProviderSessionId(sessionContext.toolSession.toolSessionId, preview.toolName) : void 0;
-  let toolResult;
-  const stopLeaseRenewal = startWorkLeaseRenewal({ apiClient, projectId, repositoryLinkId, runnerId, toolConfig, workItem: result.workItem, telemetry: isolationTelemetry, heartbeatConcurrency });
-  try {
-    toolResult = await builtinAmistioHarnessAdapter.executeRun({
-      preparedRun: preparedHarnessRun,
+    const resolvedModelConfig = toolConfigModelOptions(toolConfig);
+    const preparedHarnessRun = await builtinAmistioHarnessAdapter.createRunPreview({
       rootDir: executionRoot,
       prompt,
       tool: toolConfig.tool,
       invocationChannel: toolConfig.requestedInvocationChannel ?? "auto",
       ...toolCommand ? { toolCommand } : {},
       ...resolvedModelConfig,
-      streamOutput: stream,
-      timeoutMs: toolTimeoutMs,
-      ...sessionContext.toolSession ? {
-        session: {
-          toolSessionId: sessionContext.toolSession.toolSessionId,
-          policy: sessionContext.policy,
-          decision: sessionContext.decision,
-          ...providerSessionId ? { providerSessionId } : {}
-        }
-      } : {}
+      executionPolicy: {
+        executionRoot,
+        mutationPolicy: harnessMutationPolicyForWorkItem(result.workItem),
+        claimLaneId
+      }
     });
-  } catch (error) {
-    stopLeaseRenewal();
-    const detail = truncateLogExcerpt(errorDetail(error));
-    const durationMs2 = Date.now() - startedAt;
-    const message = `${preview.toolName} failed before returning a result.`;
-    const settlements = await Promise.allSettled([
-      apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig, currentRunnerMode(), heartbeatConcurrency)),
-      markToolSessionBlocked(apiClient, projectId, sessionContext.toolSession, errorMessage7(error)),
-      apiClient.updateWorkStatus(projectId, result.workItem.workItemId, "failed", `run_failed_${result.workItem.workItemId}_${result.workItem.attempt}_${runnerId}`, runnerId, {
-        ...isolationTelemetry,
-        tool: preview.toolName,
-        ...toolConfig.model ? { model: toolConfig.model } : {},
-        durationMs: durationMs2,
-        message,
-        error: detail,
-        ...result.workItem.workKind === "promptBatch" ? { promptBatch: finalizePromptBatchMetadata(result.workItem, "failed", detail) } : {},
-        ...sessionContext.toolSession ? { toolSessionId: sessionContext.toolSession.toolSessionId } : {},
-        sessionPolicy: sessionContext.policy,
-        sessionDecision: sessionContext.decision,
-        sessionDecisionReason: sessionContext.reason
-      }),
-      recordRunnerMilestone(apiClient, projectId, result.workItem, runnerId, repositoryLinkId, {
-        status: "failed",
-        summary: message,
-        idempotencyKey: `runner_milestone_tool_throw_${result.workItem.workItemId}_${result.workItem.attempt}`,
-        metadata: { tool: preview.toolName, error: detail }
-      })
-    ]);
-    logRejectedSettlements("record local tool failure", settlements);
-    if (verbose || !stream) {
-      console.error(detail);
+    const preview = preparedHarnessRun.preview;
+    const sessionContext = await prepareToolSession({
+      apiClient,
+      projectId,
+      repositoryLinkId,
+      runnerId,
+      machineId: runnerMachineId(),
+      sessionPolicy: result.workItem.sessionPolicy ?? sessionPolicy,
+      toolName: preview.toolName,
+      ...toolConfig.model ? { model: toolConfig.model } : {},
+      supportsSessionReuse: preview.supportsSessionReuse,
+      resumabilityScope: preview.resumabilityScope,
+      workItem: result.workItem,
+      isolationTelemetry
+    });
+    console.log(`Claimed ${result.workItem.workItemId}. Running ${preview.toolName}: ${preview.displayCommand}`);
+    const autopilotClaimLine = formatAutopilotClaimLine(result.workItem);
+    if (autopilotClaimLine) {
+      console.log(autopilotClaimLine);
     }
-    return { status: "failed", exitCode: 1, message };
-  }
-  stopLeaseRenewal();
-  if (sessionContext.toolSession && toolResult.providerSessionId) {
-    await providerSessionStore.setProviderSessionId(sessionContext.toolSession.toolSessionId, preview.toolName, toolResult.providerSessionId);
-  }
-  if (!stream && toolResult.stdout.trim()) {
-    console.log(toolResult.stdout.trim());
-  }
-  if (!stream && toolResult.stderr.trim()) {
-    console.error(toolResult.stderr.trim());
-  }
-  if (result.workItem.workKind === "brainGeneration" || result.workItem.workKind === "planRevision") {
-    try {
-      return await finalizeBrainGenerationWork({
-        apiClient,
-        durationMs: Date.now() - startedAt,
-        projectId,
-        repositoryLinkId,
-        runnerId,
-        sessionContext,
-        toolConfig,
-        toolName: preview.toolName,
-        toolResult,
-        workItem: result.workItem
-      });
-    } catch (error) {
-      return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+    const promptBatchClaimLine = formatPromptBatchClaimLine(result.workItem);
+    if (promptBatchClaimLine) {
+      console.log(promptBatchClaimLine);
     }
-  }
-  if (result.workItem.workKind === "assistantQuestion") {
+    await recordRunnerMilestone(apiClient, projectId, result.workItem, runnerId, repositoryLinkId, {
+      status: "running",
+      summary: `Local runner started ${preview.toolName} execution.`,
+      idempotencyKey: `runner_milestone_started_${result.workItem.workItemId}_${result.workItem.attempt}`,
+      metadata: {
+        tool: preview.toolName,
+        invocationChannel: toolConfig.requestedInvocationChannel ?? "auto",
+        claimLaneId: preparedHarnessRun.concurrency.claimLaneId,
+        harnessSupportsConcurrentRuns: preparedHarnessRun.concurrency.supportsConcurrentRuns,
+        harnessRequiresExclusiveRepository: preparedHarnessRun.concurrency.requiresExclusiveRepository,
+        harnessRequiresExclusiveProviderAuth: preparedHarnessRun.concurrency.requiresExclusiveProviderAuth,
+        harnessSerializedResourceKeys: preparedHarnessRun.concurrency.serializedResourceKeys
+      }
+    });
+    const startedAt = Date.now();
+    const providerSessionStore = new LocalToolSessionStore();
+    const providerSessionId = sessionContext.toolSession ? await providerSessionStore.getProviderSessionId(sessionContext.toolSession.toolSessionId, preview.toolName) : void 0;
+    let toolResult;
+    const stopLeaseRenewal = startWorkLeaseRenewal({ apiClient, projectId, repositoryLinkId, runnerId, toolConfig, workItem: result.workItem, telemetry: isolationTelemetry, heartbeatConcurrency });
     try {
-      return await finalizeAssistantQuestionWork({
-        apiClient,
-        durationMs: Date.now() - startedAt,
-        projectId,
-        repositoryLinkId,
-        runnerId,
-        sessionContext,
-        toolConfig,
-        toolName: preview.toolName,
-        toolResult,
-        workItem: result.workItem
+      toolResult = await builtinAmistioHarnessAdapter.executeRun({
+        preparedRun: preparedHarnessRun,
+        rootDir: executionRoot,
+        prompt,
+        tool: toolConfig.tool,
+        invocationChannel: toolConfig.requestedInvocationChannel ?? "auto",
+        ...toolCommand ? { toolCommand } : {},
+        ...resolvedModelConfig,
+        streamOutput: stream,
+        timeoutMs: toolTimeoutMs,
+        ...sessionContext.toolSession ? {
+          session: {
+            toolSessionId: sessionContext.toolSession.toolSessionId,
+            policy: sessionContext.policy,
+            decision: sessionContext.decision,
+            ...providerSessionId ? { providerSessionId } : {}
+          }
+        } : {}
       });
     } catch (error) {
-      return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+      stopLeaseRenewal();
+      const detail = truncateLogExcerpt(errorDetail(error));
+      const durationMs2 = Date.now() - startedAt;
+      const message = `${preview.toolName} failed before returning a result.`;
+      const settlements = await Promise.allSettled([
+        apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig, currentRunnerMode(), heartbeatConcurrency)),
+        markToolSessionBlocked(apiClient, projectId, sessionContext.toolSession, errorMessage7(error)),
+        apiClient.updateWorkStatus(projectId, result.workItem.workItemId, "failed", `run_failed_${result.workItem.workItemId}_${result.workItem.attempt}_${runnerId}`, runnerId, {
+          ...isolationTelemetry,
+          tool: preview.toolName,
+          ...toolConfig.model ? { model: toolConfig.model } : {},
+          durationMs: durationMs2,
+          message,
+          error: detail,
+          ...result.workItem.workKind === "promptBatch" ? { promptBatch: finalizePromptBatchMetadata(result.workItem, "failed", detail) } : {},
+          ...sessionContext.toolSession ? { toolSessionId: sessionContext.toolSession.toolSessionId } : {},
+          sessionPolicy: sessionContext.policy,
+          sessionDecision: sessionContext.decision,
+          sessionDecisionReason: sessionContext.reason
+        }),
+        recordRunnerMilestone(apiClient, projectId, result.workItem, runnerId, repositoryLinkId, {
+          status: "failed",
+          summary: message,
+          idempotencyKey: `runner_milestone_tool_throw_${result.workItem.workItemId}_${result.workItem.attempt}`,
+          metadata: { tool: preview.toolName, error: detail }
+        })
+      ]);
+      logRejectedSettlements("record local tool failure", settlements);
+      if (verbose || !stream) {
+        console.error(detail);
+      }
+      return { status: "failed", exitCode: 1, message };
     }
-  }
-  if (result.workItem.workKind === "impactPreview") {
-    try {
-      return await finalizeImpactPreviewWork({
-        apiClient,
-        durationMs: Date.now() - startedAt,
-        projectId,
-        repositoryLinkId,
-        root,
-        runnerId,
-        sessionContext,
-        toolConfig,
-        toolName: preview.toolName,
-        toolResult,
-        workItem: result.workItem
-      });
-    } catch (error) {
-      return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+    stopLeaseRenewal();
+    if (sessionContext.toolSession && toolResult.providerSessionId) {
+      await providerSessionStore.setProviderSessionId(sessionContext.toolSession.toolSessionId, preview.toolName, toolResult.providerSessionId);
     }
-  }
-  if (result.workItem.workKind === "issueDiagnosis") {
-    try {
-      return await finalizeIssueDiagnosisWork({
-        apiClient,
-        durationMs: Date.now() - startedAt,
-        projectId,
-        repositoryLinkId,
-        runnerId,
-        sessionContext,
-        toolConfig,
-        toolName: preview.toolName,
-        toolResult,
-        workItem: result.workItem
-      });
-    } catch (error) {
-      return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+    if (!stream && toolResult.stdout.trim()) {
+      console.log(toolResult.stdout.trim());
     }
-  }
-  if (result.workItem.workKind === "securityPostureScan") {
-    try {
-      return await finalizeSecurityPostureScanWork({
-        apiClient,
-        durationMs: Date.now() - startedAt,
-        projectId,
-        repositoryLinkId,
-        runnerId,
-        sessionContext,
-        toolConfig,
-        toolName: preview.toolName,
-        toolResult,
-        workItem: result.workItem
-      });
-    } catch (error) {
-      return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+    if (!stream && toolResult.stderr.trim()) {
+      console.error(toolResult.stderr.trim());
     }
-  }
-  if (result.workItem.workKind === "appEvaluationScan") {
-    try {
-      return await finalizeAppEvaluationScanWork({
-        apiClient,
-        durationMs: Date.now() - startedAt,
-        projectId,
-        repositoryLinkId,
-        runnerId,
-        sessionContext,
-        toolConfig,
-        toolName: preview.toolName,
-        toolResult,
-        workItem: result.workItem
-      });
-    } catch (error) {
-      return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+    if (result.workItem.workKind === "brainGeneration" || result.workItem.workKind === "planRevision") {
+      try {
+        return await finalizeBrainGenerationWork({
+          apiClient,
+          durationMs: Date.now() - startedAt,
+          projectId,
+          repositoryLinkId,
+          runnerId,
+          sessionContext,
+          toolConfig,
+          toolName: preview.toolName,
+          toolResult,
+          workItem: result.workItem
+        });
+      } catch (error) {
+        return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+      }
     }
-  }
-  if (result.workItem.workKind === "brainConsolidationScan") {
-    try {
-      return await finalizeBrainConsolidationScanWork({
-        apiClient,
-        durationMs: Date.now() - startedAt,
-        projectId,
-        repositoryLinkId,
-        runnerId,
-        sessionContext,
-        toolConfig,
-        toolName: preview.toolName,
-        toolResult,
-        workItem: result.workItem
-      });
-    } catch (error) {
-      return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+    if (result.workItem.workKind === "assistantQuestion") {
+      try {
+        return await finalizeAssistantQuestionWork({
+          apiClient,
+          durationMs: Date.now() - startedAt,
+          projectId,
+          repositoryLinkId,
+          runnerId,
+          sessionContext,
+          toolConfig,
+          toolName: preview.toolName,
+          toolResult,
+          workItem: result.workItem
+        });
+      } catch (error) {
+        return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+      }
     }
-  }
-  if (result.workItem.workKind === "projectContextRefresh") {
-    try {
-      return await finalizeProjectContextRefreshWork({
-        apiClient,
-        durationMs: Date.now() - startedAt,
-        executionRoot,
-        projectId,
-        repositoryLinkId,
-        runnerId,
-        sessionContext,
-        toolConfig,
-        toolName: preview.toolName,
-        toolResult,
-        workItem: result.workItem
-      });
-    } catch (error) {
-      return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+    if (result.workItem.workKind === "impactPreview") {
+      try {
+        return await finalizeImpactPreviewWork({
+          apiClient,
+          durationMs: Date.now() - startedAt,
+          projectId,
+          repositoryLinkId,
+          root,
+          runnerId,
+          sessionContext,
+          toolConfig,
+          toolName: preview.toolName,
+          toolResult,
+          workItem: result.workItem
+        });
+      } catch (error) {
+        return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+      }
     }
-  }
-  if (result.workItem.workKind === "implementationVerification") {
-    try {
-      return await finalizeImplementationVerificationWork({
-        apiClient,
-        durationMs: Date.now() - startedAt,
-        projectId,
-        repositoryLinkId,
-        runnerId,
-        sessionContext,
-        toolConfig,
-        toolName: preview.toolName,
-        toolResult,
-        workItem: result.workItem
+    if (result.workItem.workKind === "issueDiagnosis") {
+      try {
+        return await finalizeIssueDiagnosisWork({
+          apiClient,
+          durationMs: Date.now() - startedAt,
+          projectId,
+          repositoryLinkId,
+          runnerId,
+          sessionContext,
+          toolConfig,
+          toolName: preview.toolName,
+          toolResult,
+          workItem: result.workItem
+        });
+      } catch (error) {
+        return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+      }
+    }
+    if (result.workItem.workKind === "securityPostureScan") {
+      try {
+        return await finalizeSecurityPostureScanWork({
+          apiClient,
+          durationMs: Date.now() - startedAt,
+          projectId,
+          repositoryLinkId,
+          runnerId,
+          sessionContext,
+          toolConfig,
+          toolName: preview.toolName,
+          toolResult,
+          workItem: result.workItem
+        });
+      } catch (error) {
+        return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+      }
+    }
+    if (result.workItem.workKind === "appEvaluationScan") {
+      try {
+        return await finalizeAppEvaluationScanWork({
+          apiClient,
+          durationMs: Date.now() - startedAt,
+          projectId,
+          repositoryLinkId,
+          runnerId,
+          sessionContext,
+          toolConfig,
+          toolName: preview.toolName,
+          toolResult,
+          workItem: result.workItem
+        });
+      } catch (error) {
+        return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+      }
+    }
+    if (result.workItem.workKind === "brainConsolidationScan") {
+      try {
+        return await finalizeBrainConsolidationScanWork({
+          apiClient,
+          durationMs: Date.now() - startedAt,
+          projectId,
+          repositoryLinkId,
+          runnerId,
+          sessionContext,
+          toolConfig,
+          toolName: preview.toolName,
+          toolResult,
+          workItem: result.workItem
+        });
+      } catch (error) {
+        return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+      }
+    }
+    if (result.workItem.workKind === "projectContextRefresh") {
+      try {
+        return await finalizeProjectContextRefreshWork({
+          apiClient,
+          durationMs: Date.now() - startedAt,
+          executionRoot,
+          projectId,
+          repositoryLinkId,
+          runnerId,
+          sessionContext,
+          toolConfig,
+          toolName: preview.toolName,
+          toolResult,
+          workItem: result.workItem
+        });
+      } catch (error) {
+        return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+      }
+    }
+    if (result.workItem.workKind === "implementationVerification") {
+      try {
+        return await finalizeImplementationVerificationWork({
+          apiClient,
+          durationMs: Date.now() - startedAt,
+          projectId,
+          repositoryLinkId,
+          runnerId,
+          sessionContext,
+          toolConfig,
+          toolName: preview.toolName,
+          toolResult,
+          workItem: result.workItem
+        });
+      } catch (error) {
+        return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+      }
+    }
+    if (result.workItem.workKind === "testQualityScan") {
+      try {
+        return await finalizeTestQualityScanWork({
+          apiClient,
+          durationMs: Date.now() - startedAt,
+          projectId,
+          repositoryLinkId,
+          runnerId,
+          sessionContext,
+          toolConfig,
+          toolName: preview.toolName,
+          toolResult,
+          workItem: result.workItem
+        });
+      } catch (error) {
+        return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+      }
+    }
+    if (result.workItem.workKind === "implementationTestGate") {
+      try {
+        return await finalizeImplementationTestGateWork({
+          apiClient,
+          durationMs: Date.now() - startedAt,
+          projectId,
+          repositoryLinkId,
+          runnerId,
+          sessionContext,
+          toolConfig,
+          toolName: preview.toolName,
+          toolResult,
+          workItem: result.workItem
+        });
+      } catch (error) {
+        return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+      }
+    }
+    let finalStatus = toolResult.exitCode === 0 ? "completed" : "failed";
+    const durationMs = Date.now() - startedAt;
+    const promptBatchResult = result.workItem.workKind === "promptBatch" ? parsePromptBatchResultBestEffort(toolResult) : void 0;
+    const promptBatchFinalStatus = promptBatchResult ? workStatusFromPromptBatchResult(promptBatchResult) : void 0;
+    if (promptBatchFinalStatus && (toolResult.exitCode === 0 || promptBatchFinalStatus !== "completed")) {
+      finalStatus = promptBatchFinalStatus;
+    }
+    const failureExcerpt = finalStatus === "completed" ? void 0 : truncateLogExcerpt(toolResult.stderr || toolResult.stdout);
+    let implementationHandoff;
+    let finalMessage = `${preview.toolName} exited with code ${toolResult.exitCode}.`;
+    let finalError = failureExcerpt ?? promptBatchFailureReason(promptBatchResult);
+    const patchDrift = finalStatus !== "completed" ? classifyPatchDriftToolResult(toolResult) : void 0;
+    if (patchDrift) {
+      finalStatus = "blocked";
+      finalMessage = patchDrift.message;
+      finalError = patchDrift.summary;
+      implementationHandoff = {
+        status: "blocked",
+        cleanupStatus: "pending",
+        message: patchDrift.message,
+        error: patchDrift.summary,
+        recovery: {
+          category: "patchDrift",
+          availableActions: ["requeueFreshAttempt", "exportHandoffDetails"],
+          conflictFiles: [],
+          summary: "The local patch did not match the current worktree context. Refresh context or queue a fresh linked attempt before retrying.",
+          ...isolationTelemetry.executionWorktreeKey ? { worktreeKey: isolationTelemetry.executionWorktreeKey } : {}
+        }
+      };
+    }
+    if (promptBatchResult && finalStatus !== "completed" && toolResult.exitCode === 0) {
+      finalMessage = "Prompt batch reported a failed or blocked child prompt.";
+    }
+    if (finalStatus === "completed" && isImplementationHandoffWork(result.workItem)) {
+      await recordRunnerMilestone(apiClient, projectId, result.workItem, runnerId, repositoryLinkId, {
+        status: "running",
+        summary: "Preparing GitHub PR handoff for implementation work.",
+        idempotencyKey: `runner_milestone_handoff_started_${result.workItem.workItemId}_${result.workItem.attempt}`,
+        metadata: { executionWorktreeKey: isolationTelemetry.executionWorktreeKey ?? "", executionBranch: isolationTelemetry.executionBranch ?? "" }
       });
-    } catch (error) {
-      return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+      const repositoryLink = await loadWorkItemRepositoryLink(apiClient, projectId, result.workItem.repositoryLinkId ?? repositoryLinkId);
+      const approvedArtifacts = await apiClient.listBrainDocuments(projectId).then((response) => response.documents).catch((error) => {
+        implementationHandoff = {
+          status: "blocked",
+          cleanupStatus: "pending",
+          artifacts: { included: [], skipped: [], blocked: [] },
+          message: "Implementation handoff is blocked because approved artifact metadata could not be loaded.",
+          error: truncateLogExcerpt(errorDetail(error))
+        };
+        return void 0;
+      });
+      if (!implementationHandoff) {
+        implementationHandoff = await completeImplementationHandoff({
+          ...approvedArtifacts ? { approvedArtifacts } : {},
+          primaryRepoRoot: root,
+          ...repositoryLink ? { repositoryLink } : {},
+          verificationSummary: "Local execution reported completion.",
+          workItem: result.workItem,
+          ...worktreeIsolation.isolation ? { worktreeIsolation: worktreeIsolation.isolation } : {},
+          worktreePath: executionRoot
+        });
+      }
+      finalStatus = workStatusFromImplementationHandoff(implementationHandoff);
+      finalMessage = implementationHandoff.message ?? "Implementation handoff finished.";
+      finalError = implementationHandoff.error;
     }
-  }
-  if (result.workItem.workKind === "testQualityScan") {
+    const updatedToolSession = await finalizeToolSession({
+      apiClient,
+      projectId,
+      status: toolResult.exitCode === 0 ? "completed" : "failed",
+      runnerId,
+      workItemId: result.workItem.workItemId,
+      stdout: toolResult.stdout,
+      ...sessionContext.toolSession ? { session: sessionContext.toolSession } : {},
+      ...toolResult.messageCount !== void 0 ? { messageCount: toolResult.messageCount } : {},
+      ...toolResult.tokensIn !== void 0 ? { tokensIn: toolResult.tokensIn } : {},
+      ...toolResult.tokensOut !== void 0 ? { tokensOut: toolResult.tokensOut } : {},
+      ...toolResult.costUsd !== void 0 ? { costUsd: toolResult.costUsd } : {}
+    });
+    let statusResult;
+    const finalizationIdempotencyKey = `run_${result.workItem.workItemId}_${randomUUID4()}`;
+    const finalizationTelemetry = {
+      tool: preview.toolName,
+      ...toolResult.model ? { model: toolResult.model } : {},
+      durationMs,
+      message: finalMessage,
+      ...isolationTelemetry,
+      ...finalStatus === "blocked" ? { blockerReason: finalMessage } : {},
+      sessionPolicy: sessionContext.policy,
+      sessionDecision: sessionContext.decision,
+      sessionDecisionReason: sessionContext.reason,
+      ...updatedToolSession ? { toolSessionId: updatedToolSession.toolSessionId } : {},
+      ...updatedToolSession?.sessionGroupKey ? { sessionGroupKey: updatedToolSession.sessionGroupKey } : {},
+      ...toolResult.tokensIn !== void 0 ? { tokensIn: toolResult.tokensIn } : {},
+      ...toolResult.tokensOut !== void 0 ? { tokensOut: toolResult.tokensOut } : {},
+      ...toolResult.costUsd !== void 0 ? { costUsd: toolResult.costUsd } : {},
+      ...implementationHandoff ? { implementationHandoff } : {},
+      ...result.workItem.workKind === "promptBatch" ? { promptBatch: finalizePromptBatchMetadata(result.workItem, finalStatus, finalError, promptBatchResult) } : {},
+      ...finalError ? { error: finalError } : {}
+    };
     try {
-      return await finalizeTestQualityScanWork({
-        apiClient,
-        durationMs: Date.now() - startedAt,
+      const implementationFinalization = isNonMutatingImplementationOutcome(result.workItem) ? await submitNonMutatingImplementationCompletion(apiClient, {
+        attempt: result.workItem.attempt,
+        finalStatus,
+        idempotencyKey: finalizationIdempotencyKey,
         projectId,
-        repositoryLinkId,
         runnerId,
-        sessionContext,
-        toolConfig,
-        toolName: preview.toolName,
-        toolResult,
-        workItem: result.workItem
-      });
-    } catch (error) {
-      return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
-    }
-  }
-  if (result.workItem.workKind === "implementationTestGate") {
-    try {
-      return await finalizeImplementationTestGateWork({
-        apiClient,
-        durationMs: Date.now() - startedAt,
+        telemetry: finalizationTelemetry,
+        workItemId: result.workItem.workItemId
+      }) : await submitStagedImplementationFinalization(apiClient, {
+        accountId: commandContext.accountId,
+        attempt: result.workItem.attempt,
+        finalStatus,
+        idempotencyKey: finalizationIdempotencyKey,
         projectId,
         repositoryLinkId,
         runnerId,
-        sessionContext,
-        toolConfig,
-        toolName: preview.toolName,
-        toolResult,
-        workItem: result.workItem
+        telemetry: implementationFinalizationTelemetry(finalizationTelemetry),
+        workItemId: result.workItem.workItemId,
+        workKind: result.workItem.workKind === "promptBatch" ? "promptBatch" : "implementation"
       });
+      if (implementationFinalization.status === "failed") {
+        if (implementationFinalization.retryable) {
+          await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig, currentRunnerMode(), heartbeatConcurrency)).catch(() => void 0);
+          return { status: "blocked", exitCode: 0, message: implementationFinalization.message };
+        }
+        throw new Error(implementationFinalization.message);
+      }
+      if (implementationFinalization.status === "deferred") {
+        const gateMessage = "Implementation test gate was queued and must pass before completion or PR handoff is finalized.";
+        await recordRunnerMilestone(apiClient, projectId, result.workItem, runnerId, repositoryLinkId, {
+          status: "queued",
+          summary: gateMessage,
+          idempotencyKey: `runner_milestone_test_gate_required_${result.workItem.workItemId}_${result.workItem.attempt}`,
+          metadata: { tool: preview.toolName, durationMs, executionWorktreeKey: isolationTelemetry.executionWorktreeKey ?? "", executionBranch: isolationTelemetry.executionBranch ?? "" }
+        });
+        await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig, currentRunnerMode(), heartbeatConcurrency));
+        console.log(gateMessage);
+        return { status: "blocked", exitCode: 0, message: gateMessage };
+      }
+      statusResult = { workItem: implementationFinalization.workItem };
     } catch (error) {
-      return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
-    }
-  }
-  let finalStatus = toolResult.exitCode === 0 ? "completed" : "failed";
-  const durationMs = Date.now() - startedAt;
-  const promptBatchResult = result.workItem.workKind === "promptBatch" ? parsePromptBatchResultBestEffort(toolResult) : void 0;
-  const promptBatchFinalStatus = promptBatchResult ? workStatusFromPromptBatchResult(promptBatchResult) : void 0;
-  if (promptBatchFinalStatus && (toolResult.exitCode === 0 || promptBatchFinalStatus !== "completed")) {
-    finalStatus = promptBatchFinalStatus;
-  }
-  const failureExcerpt = finalStatus === "completed" ? void 0 : truncateLogExcerpt(toolResult.stderr || toolResult.stdout);
-  let implementationHandoff;
-  let finalMessage = `${preview.toolName} exited with code ${toolResult.exitCode}.`;
-  let finalError = failureExcerpt ?? promptBatchFailureReason(promptBatchResult);
-  const patchDrift = finalStatus !== "completed" ? classifyPatchDriftToolResult(toolResult) : void 0;
-  if (patchDrift) {
-    finalStatus = "blocked";
-    finalMessage = patchDrift.message;
-    finalError = patchDrift.summary;
-    implementationHandoff = {
-      status: "blocked",
-      cleanupStatus: "pending",
-      message: patchDrift.message,
-      error: patchDrift.summary,
-      recovery: {
-        category: "patchDrift",
-        availableActions: ["requeueFreshAttempt", "exportHandoffDetails"],
-        conflictFiles: [],
-        summary: "The local patch did not match the current worktree context. Refresh context or queue a fresh linked attempt before retrying.",
-        ...isolationTelemetry.executionWorktreeKey ? { worktreeKey: isolationTelemetry.executionWorktreeKey } : {}
+      if (error instanceof AmistioApiError && error.status === 409 && error.detail.includes("implementation_test_gate_required")) {
+        const gateMessage = "Implementation test gate was queued and must pass before completion or PR handoff is finalized.";
+        await recordRunnerMilestone(apiClient, projectId, result.workItem, runnerId, repositoryLinkId, {
+          status: "queued",
+          summary: gateMessage,
+          idempotencyKey: `runner_milestone_test_gate_required_${result.workItem.workItemId}_${result.workItem.attempt}`,
+          metadata: { tool: preview.toolName, durationMs, executionWorktreeKey: isolationTelemetry.executionWorktreeKey ?? "", executionBranch: isolationTelemetry.executionBranch ?? "" }
+        });
+        await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig, currentRunnerMode(), heartbeatConcurrency));
+        console.log(gateMessage);
+        return { status: "blocked", exitCode: 0 };
       }
-    };
-  }
-  if (promptBatchResult && finalStatus !== "completed" && toolResult.exitCode === 0) {
-    finalMessage = "Prompt batch reported a failed or blocked child prompt.";
-  }
-  if (finalStatus === "completed" && isImplementationHandoffWork(result.workItem)) {
+      throw error;
+    }
     await recordRunnerMilestone(apiClient, projectId, result.workItem, runnerId, repositoryLinkId, {
-      status: "running",
-      summary: "Preparing GitHub PR handoff for implementation work.",
-      idempotencyKey: `runner_milestone_handoff_started_${result.workItem.workItemId}_${result.workItem.attempt}`,
-      metadata: { executionWorktreeKey: isolationTelemetry.executionWorktreeKey ?? "", executionBranch: isolationTelemetry.executionBranch ?? "" }
-    });
-    const repositoryLink = await loadWorkItemRepositoryLink(apiClient, projectId, result.workItem.repositoryLinkId ?? repositoryLinkId);
-    const approvedArtifacts = await apiClient.listBrainDocuments(projectId).then((response) => response.documents).catch((error) => {
-      implementationHandoff = {
-        status: "blocked",
-        cleanupStatus: "pending",
-        artifacts: { included: [], skipped: [], blocked: [] },
-        message: "Implementation handoff is blocked because approved artifact metadata could not be loaded.",
-        error: truncateLogExcerpt(errorDetail(error))
-      };
-      return void 0;
+      status: finalStatus,
+      summary: finalMessage,
+      idempotencyKey: `runner_milestone_finished_${result.workItem.workItemId}_${statusResult.workItem.idempotencyKey}`,
+      metadata: {
+        tool: preview.toolName,
+        durationMs,
+        exitCode: toolResult.exitCode,
+        verificationSummary: finalStatus === "completed" ? "Local execution reported completion." : "Local execution reported failure.",
+        executionWorktreeKey: isolationTelemetry.executionWorktreeKey ?? "",
+        executionBranch: isolationTelemetry.executionBranch ?? "",
+        ...implementationHandoff?.status ? { handoffStatus: implementationHandoff.status } : {},
+        ...implementationHandoff?.prUrl ? { prUrl: implementationHandoff.prUrl } : {},
+        ...implementationHandoff?.cleanupStatus ? { cleanupStatus: implementationHandoff.cleanupStatus } : {},
+        ...implementationHandoff?.artifacts ? artifactHandoffMetadata(implementationHandoff.artifacts) : {}
+      }
     });
-    if (!implementationHandoff) {
-      implementationHandoff = await completeImplementationHandoff({
-        ...approvedArtifacts ? { approvedArtifacts } : {},
-        primaryRepoRoot: root,
-        ...repositoryLink ? { repositoryLink } : {},
-        verificationSummary: "Local execution reported completion.",
-        workItem: result.workItem,
-        ...worktreeIsolation.isolation ? { worktreeIsolation: worktreeIsolation.isolation } : {},
-        worktreePath: executionRoot
-      });
-    }
-    finalStatus = workStatusFromImplementationHandoff(implementationHandoff);
-    finalMessage = implementationHandoff.message ?? "Implementation handoff finished.";
-    finalError = implementationHandoff.error;
+    await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig, currentRunnerMode(), heartbeatConcurrency));
+    const durationSeconds = Math.round(durationMs / 1e3);
+    console.log(`Marked ${statusResult.workItem.workItemId} ${statusResult.workItem.status} after ${durationSeconds}s.`);
+    return { status: finalStatus, exitCode: finalStatus === "completed" ? toolResult.exitCode : 1 };
+  } finally {
+    await releaseLocalActiveClaim();
   }
-  const updatedToolSession = await finalizeToolSession({
-    apiClient,
-    projectId,
-    status: toolResult.exitCode === 0 ? "completed" : "failed",
+}
+function runnerActiveClaimInput({ accountId, claimLaneId, repositoryLinkId, runnerId, toolTimeoutMs, workItem }) {
+  const identity = needsGitWorktreeIsolation(workItem) ? resolveWorktreeIdentity(workItem) : void 0;
+  const implementationScopeId = identity?.implementationScopeId ?? workItem.implementationScopeId;
+  const worktreeKey = identity?.worktreeKey ?? workItem.executionWorktreeKey;
+  const executionBranch = identity?.branch ?? workItem.executionBranch;
+  const expiresAtMs = Date.now() + Math.max(toolTimeoutMs, RUNNER_WORK_LEASE_SECONDS * 1e3) + RUNNER_WORK_LEASE_SECONDS * 1e3;
+  return {
+    accountId,
+    projectId: workItem.projectId,
+    repositoryLinkId: workItem.repositoryLinkId ?? repositoryLinkId,
     runnerId,
-    workItemId: result.workItem.workItemId,
-    stdout: toolResult.stdout,
-    ...sessionContext.toolSession ? { session: sessionContext.toolSession } : {},
-    ...toolResult.messageCount !== void 0 ? { messageCount: toolResult.messageCount } : {},
-    ...toolResult.tokensIn !== void 0 ? { tokensIn: toolResult.tokensIn } : {},
-    ...toolResult.tokensOut !== void 0 ? { tokensOut: toolResult.tokensOut } : {},
-    ...toolResult.costUsd !== void 0 ? { costUsd: toolResult.costUsd } : {}
-  });
-  let statusResult;
-  const finalizationIdempotencyKey = `run_${result.workItem.workItemId}_${randomUUID3()}`;
-  const finalizationTelemetry = {
-    tool: preview.toolName,
-    ...toolResult.model ? { model: toolResult.model } : {},
-    durationMs,
-    message: finalMessage,
-    ...isolationTelemetry,
-    ...finalStatus === "blocked" ? { blockerReason: finalMessage } : {},
-    sessionPolicy: sessionContext.policy,
-    sessionDecision: sessionContext.decision,
-    sessionDecisionReason: sessionContext.reason,
-    ...updatedToolSession ? { toolSessionId: updatedToolSession.toolSessionId } : {},
-    ...updatedToolSession?.sessionGroupKey ? { sessionGroupKey: updatedToolSession.sessionGroupKey } : {},
-    ...toolResult.tokensIn !== void 0 ? { tokensIn: toolResult.tokensIn } : {},
-    ...toolResult.tokensOut !== void 0 ? { tokensOut: toolResult.tokensOut } : {},
-    ...toolResult.costUsd !== void 0 ? { costUsd: toolResult.costUsd } : {},
-    ...implementationHandoff ? { implementationHandoff } : {},
-    ...result.workItem.workKind === "promptBatch" ? { promptBatch: finalizePromptBatchMetadata(result.workItem, finalStatus, finalError, promptBatchResult) } : {},
-    ...finalError ? { error: finalError } : {}
+    claimLaneId,
+    workItemId: workItem.workItemId,
+    ...workItem.claimLeaseId ? { claimLeaseId: workItem.claimLeaseId } : {},
+    attempt: workItem.attempt,
+    ...implementationScopeId ? { implementationScopeId } : {},
+    ...worktreeKey ? { worktreeKey } : {},
+    ...executionBranch ? { executionBranch } : {},
+    expiresAt: new Date(expiresAtMs).toISOString()
   };
-  try {
-    const implementationFinalization = isNonMutatingImplementationOutcome(result.workItem) ? await submitNonMutatingImplementationCompletion(apiClient, {
-      attempt: result.workItem.attempt,
-      finalStatus,
-      idempotencyKey: finalizationIdempotencyKey,
-      projectId,
+}
+async function releaseSkippedLocalClaim({ apiClient, claimLaneId, conflict, projectId, repositoryLinkId, runnerId, workItem }) {
+  const message = activeClaimConflictMessage(conflict);
+  await apiClient.updateWorkStatus(projectId, workItem.workItemId, "approved", `local_claim_conflict_${workItem.workItemId}_${workItem.attempt}_${randomUUID4()}`, runnerId, {
+    ...workItemIsolationTelemetry(workItem, void 0),
+    claimLaneId,
+    message,
+    releaseClaim: true
+  }).catch(async (error) => {
+    await apiClient.recordRunnerLog(projectId, {
       runnerId,
-      telemetry: finalizationTelemetry,
-      workItemId: result.workItem.workItemId
-    }) : await submitStagedImplementationFinalization(apiClient, {
-      accountId: commandContext.accountId,
-      attempt: result.workItem.attempt,
-      finalStatus,
-      idempotencyKey: finalizationIdempotencyKey,
-      projectId,
       repositoryLinkId,
-      runnerId,
-      telemetry: implementationFinalizationTelemetry(finalizationTelemetry),
-      workItemId: result.workItem.workItemId,
-      workKind: result.workItem.workKind === "promptBatch" ? "promptBatch" : "implementation"
-    });
-    if (implementationFinalization.status === "failed") {
-      if (implementationFinalization.retryable) {
-        await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig, currentRunnerMode(), heartbeatConcurrency)).catch(() => void 0);
-        return { status: "blocked", exitCode: 0, message: implementationFinalization.message };
-      }
-      throw new Error(implementationFinalization.message);
-    }
-    if (implementationFinalization.status === "deferred") {
-      const gateMessage = "Implementation test gate was queued and must pass before completion or PR handoff is finalized.";
-      await recordRunnerMilestone(apiClient, projectId, result.workItem, runnerId, repositoryLinkId, {
-        status: "queued",
-        summary: gateMessage,
-        idempotencyKey: `runner_milestone_test_gate_required_${result.workItem.workItemId}_${result.workItem.attempt}`,
-        metadata: { tool: preview.toolName, durationMs, executionWorktreeKey: isolationTelemetry.executionWorktreeKey ?? "", executionBranch: isolationTelemetry.executionBranch ?? "" }
-      });
-      await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig, currentRunnerMode(), heartbeatConcurrency));
-      console.log(gateMessage);
-      return { status: "blocked", exitCode: 0, message: gateMessage };
-    }
-    statusResult = { workItem: implementationFinalization.workItem };
-  } catch (error) {
-    if (error instanceof AmistioApiError && error.status === 409 && error.detail.includes("implementation_test_gate_required")) {
-      const gateMessage = "Implementation test gate was queued and must pass before completion or PR handoff is finalized.";
-      await recordRunnerMilestone(apiClient, projectId, result.workItem, runnerId, repositoryLinkId, {
-        status: "queued",
-        summary: gateMessage,
-        idempotencyKey: `runner_milestone_test_gate_required_${result.workItem.workItemId}_${result.workItem.attempt}`,
-        metadata: { tool: preview.toolName, durationMs, executionWorktreeKey: isolationTelemetry.executionWorktreeKey ?? "", executionBranch: isolationTelemetry.executionBranch ?? "" }
-      });
-      await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig, currentRunnerMode(), heartbeatConcurrency));
-      console.log(gateMessage);
-      return { status: "blocked", exitCode: 0 };
-    }
-    throw error;
-  }
-  await recordRunnerMilestone(apiClient, projectId, result.workItem, runnerId, repositoryLinkId, {
-    status: finalStatus,
-    summary: finalMessage,
-    idempotencyKey: `runner_milestone_finished_${result.workItem.workItemId}_${statusResult.workItem.idempotencyKey}`,
-    metadata: {
-      tool: preview.toolName,
-      durationMs,
-      exitCode: toolResult.exitCode,
-      verificationSummary: finalStatus === "completed" ? "Local execution reported completion." : "Local execution reported failure.",
-      executionWorktreeKey: isolationTelemetry.executionWorktreeKey ?? "",
-      executionBranch: isolationTelemetry.executionBranch ?? "",
-      ...implementationHandoff?.status ? { handoffStatus: implementationHandoff.status } : {},
-      ...implementationHandoff?.prUrl ? { prUrl: implementationHandoff.prUrl } : {},
-      ...implementationHandoff?.cleanupStatus ? { cleanupStatus: implementationHandoff.cleanupStatus } : {},
-      ...implementationHandoff?.artifacts ? artifactHandoffMetadata(implementationHandoff.artifacts) : {}
-    }
+      status: "blocked",
+      workItemId: workItem.workItemId,
+      workTitle: workItem.title,
+      ...workItem.workKind ? { workKind: workItem.workKind } : {},
+      ...claimLaneId ? { claimLaneId } : {},
+      message: "Runner skipped a locally conflicting active claim but could not release the server claim.",
+      error: truncateLogExcerpt(errorDetail(error)),
+      machineId: runnerMachineId()
+    }).catch(() => void 0);
   });
-  await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig, currentRunnerMode(), heartbeatConcurrency));
-  const durationSeconds = Math.round(durationMs / 1e3);
-  console.log(`Marked ${statusResult.workItem.workItemId} ${statusResult.workItem.status} after ${durationSeconds}s.`);
-  return { status: finalStatus, exitCode: finalStatus === "completed" ? toolResult.exitCode : 1 };
+  await apiClient.recordRunnerLog(projectId, {
+    runnerId,
+    repositoryLinkId,
+    status: "blocked",
+    workItemId: workItem.workItemId,
+    workTitle: workItem.title,
+    ...workItem.workKind ? { workKind: workItem.workKind } : {},
+    ...claimLaneId ? { claimLaneId } : {},
+    message,
+    machineId: runnerMachineId()
+  }).catch(() => void 0);
+  console.error(message);
+  return { status: "idle", exitCode: 0, message };
 }
 function artifactHandoffMetadata(artifacts) {
   return {
@@ -12644,7 +12926,7 @@ async function prepareWorktreeForClaimedItem({ apiClient, heartbeatConcurrency,
     const telemetry = workItemIsolationTelemetry(workItem, { ...identity, baseRevision: workItem.baseRevision ?? "unknown", worktreePath: "" });
     const finalAttempt = workItem.attempt >= maxPreflightAttempts;
     const statusMessage = finalAttempt ? `Git worktree preflight failed after ${workItem.attempt}/${maxPreflightAttempts} attempts. ${message}` : `Git worktree preflight attempt ${workItem.attempt}/${maxPreflightAttempts} failed. Requeueing for retry. ${message}`;
-    const statusResult = await apiClient.updateWorkStatus(projectId, workItem.workItemId, finalAttempt ? "failed" : "approved", `worktree_${finalAttempt ? "failed" : "retry"}_${workItem.workItemId}_${workItem.attempt}_${randomUUID3()}`, runnerId, {
+    const statusResult = await apiClient.updateWorkStatus(projectId, workItem.workItemId, finalAttempt ? "failed" : "approved", `worktree_${finalAttempt ? "failed" : "retry"}_${workItem.workItemId}_${workItem.attempt}_${randomUUID4()}`, runnerId, {
       ...telemetry,
       message: statusMessage,
       ...finalAttempt ? { blockerReason: message } : { releaseClaim: true },
@@ -12713,7 +12995,7 @@ async function recordFinalizationFailure({ apiClient, durationMs, error, isolati
   const settlements = await Promise.allSettled([
     apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig)),
     markToolSessionBlocked(apiClient, projectId, sessionContext.toolSession, errorMessage7(error)),
-    apiClient.updateWorkStatus(projectId, workItem.workItemId, "failed", `finalize_failed_${workItem.workItemId}_${workItem.attempt}_${randomUUID3()}`, runnerId, {
+    apiClient.updateWorkStatus(projectId, workItem.workItemId, "failed", `finalize_failed_${workItem.workItemId}_${workItem.attempt}_${randomUUID4()}`, runnerId, {
       ...isolationTelemetry,
       tool: toolName,
       durationMs,
@@ -12950,7 +13232,7 @@ async function updateRunnerCommandStatus(apiClient, context, command, status, me
     runnerId: context.runnerId,
     repositoryLinkId: context.repositoryLinkId,
     status,
-    idempotencyKey: `runner_command_${command.commandId}_${status}_${randomUUID3()}`,
+    idempotencyKey: `runner_command_${command.commandId}_${status}_${randomUUID4()}`,
     message,
     ...error ? { error } : {},
     ...providerAuthStatus ? { providerAuthStatus } : {}
@@ -13042,7 +13324,7 @@ async function findRecoveryWorkItem(apiClient, projectId, workItemId) {
   return workItems.find((item) => item.workItemId === workItemId);
 }
 async function submitRecoveredHandoff(apiClient, context, workItem, handoff, action) {
-  await apiClient.updateWorkStatus(context.projectId, workItem.workItemId, recoveredHandoffWorkStatus(handoff), `handoff_recovery_${workItem.workItemId}_${action}_${randomUUID3()}`, context.runnerId, {
+  await apiClient.updateWorkStatus(context.projectId, workItem.workItemId, recoveredHandoffWorkStatus(handoff), `handoff_recovery_${workItem.workItemId}_${action}_${randomUUID4()}`, context.runnerId, {
     implementationHandoff: handoff,
     ...handoff.message ? { message: handoff.message } : {},
     ...workItem.controllingAdrId ? { controllingAdrId: workItem.controllingAdrId } : {},
@@ -13440,7 +13722,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `generation_${workItem.workItemId}_${workItem.attempt}_${randomUUID3()}`,
+      idempotencyKey: `generation_${workItem.workItemId}_${workItem.attempt}_${randomUUID4()}`,
       artifacts,
       tool: toolName,
       durationMs,
@@ -13515,7 +13797,7 @@ ${toolResult.stderr}`);
   const failedResult2 = await apiClient.submitBrainGenerationResult(projectId, workItem.workItemId, {
     status: "failed",
     runnerId,
-    idempotencyKey: `generation_${workItem.workItemId}_${randomUUID3()}`,
+    idempotencyKey: `generation_${workItem.workItemId}_${randomUUID4()}`,
     tool: toolName,
     durationMs,
     ...failedSessionTelemetry,
@@ -13565,7 +13847,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `assistant_${workItem.workItemId}_${randomUUID3()}`,
+      idempotencyKey: `assistant_${workItem.workItemId}_${randomUUID4()}`,
       answer: answerResult.answer,
       sourceBoundary: answerResult.sourceBoundary,
       citations: answerResult.citations,
@@ -13601,7 +13883,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `assistant_${workItem.workItemId}_${randomUUID3()}`,
+    idempotencyKey: `assistant_${workItem.workItemId}_${randomUUID4()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -13664,7 +13946,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `impact_${workItem.workItemId}_${randomUUID3()}`,
+      idempotencyKey: `impact_${workItem.workItemId}_${randomUUID4()}`,
       report: {
         ...report,
         analyzedRepoRevision: report.analyzedRepoRevision ?? metadata?.lastSyncedRevision
@@ -13701,7 +13983,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `impact_${workItem.workItemId}_${randomUUID3()}`,
+    idempotencyKey: `impact_${workItem.workItemId}_${randomUUID4()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -13762,7 +14044,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `issue_${workItem.workItemId}_${randomUUID3()}`,
+      idempotencyKey: `issue_${workItem.workItemId}_${randomUUID4()}`,
       diagnosis,
       tool: toolName,
       durationMs,
@@ -13796,7 +14078,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `issue_${workItem.workItemId}_${randomUUID3()}`,
+    idempotencyKey: `issue_${workItem.workItemId}_${randomUUID4()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -13857,7 +14139,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `security_${workItem.workItemId}_${randomUUID3()}`,
+      idempotencyKey: `security_${workItem.workItemId}_${randomUUID4()}`,
       result: scanResult,
       tool: toolName,
       durationMs,
@@ -13891,7 +14173,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `security_${workItem.workItemId}_${randomUUID3()}`,
+    idempotencyKey: `security_${workItem.workItemId}_${randomUUID4()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -13952,7 +14234,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `app_evaluation_${workItem.workItemId}_${randomUUID3()}`,
+      idempotencyKey: `app_evaluation_${workItem.workItemId}_${randomUUID4()}`,
       result: scanResult,
       tool: toolName,
       durationMs,
@@ -13986,7 +14268,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `app_evaluation_${workItem.workItemId}_${randomUUID3()}`,
+    idempotencyKey: `app_evaluation_${workItem.workItemId}_${randomUUID4()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -14047,7 +14329,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `brain_consolidation_${workItem.workItemId}_${randomUUID3()}`,
+      idempotencyKey: `brain_consolidation_${workItem.workItemId}_${randomUUID4()}`,
       result: scanResult,
       tool: toolName,
       durationMs,
@@ -14081,7 +14363,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `brain_consolidation_${workItem.workItemId}_${randomUUID3()}`,
+    idempotencyKey: `brain_consolidation_${workItem.workItemId}_${randomUUID4()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -14143,7 +14425,7 @@ ${toolResult.stderr}`, { repositoryRoot: executionRoot });
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `project_context_${workItem.workItemId}_${randomUUID3()}`,
+      idempotencyKey: `project_context_${workItem.workItemId}_${randomUUID4()}`,
       result: refreshResult,
       tool: toolName,
       durationMs,
@@ -14189,7 +14471,7 @@ ${toolResult.stderr}`, { repositoryRoot: executionRoot });
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `project_context_${workItem.workItemId}_${randomUUID3()}`,
+    idempotencyKey: `project_context_${workItem.workItemId}_${randomUUID4()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -14250,7 +14532,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `implementation_verification_${workItem.workItemId}_${randomUUID3()}`,
+      idempotencyKey: `implementation_verification_${workItem.workItemId}_${randomUUID4()}`,
       result: verificationResult,
       tool: toolName,
       durationMs,
@@ -14284,7 +14566,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `implementation_verification_${workItem.workItemId}_${randomUUID3()}`,
+    idempotencyKey: `implementation_verification_${workItem.workItemId}_${randomUUID4()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -14345,7 +14627,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `test_quality_${workItem.workItemId}_${randomUUID3()}`,
+      idempotencyKey: `test_quality_${workItem.workItemId}_${randomUUID4()}`,
       result: scanResult,
       tool: toolName,
       durationMs,
@@ -14379,7 +14661,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `test_quality_${workItem.workItemId}_${randomUUID3()}`,
+    idempotencyKey: `test_quality_${workItem.workItemId}_${randomUUID4()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -14440,7 +14722,7 @@ ${toolResult.stderr}`);
     const resultMutation = {
       status: "completed",
       runnerId,
-      idempotencyKey: `implementation_test_gate_${workItem.workItemId}_${randomUUID3()}`,
+      idempotencyKey: `implementation_test_gate_${workItem.workItemId}_${randomUUID4()}`,
       result: gateResult,
       tool: toolName,
       durationMs,
@@ -14474,7 +14756,7 @@ ${toolResult.stderr}`);
   const failedMutation = {
     status: "failed",
     runnerId,
-    idempotencyKey: `implementation_test_gate_${workItem.workItemId}_${randomUUID3()}`,
+    idempotencyKey: `implementation_test_gate_${workItem.workItemId}_${randomUUID4()}`,
     tool: toolName,
     durationMs,
     ...sessionTelemetry,
@@ -14711,7 +14993,7 @@ async function prepareToolSession({
     });
     return { ...selection, toolSession: toolSession2 };
   }
-  const toolSessionId = `tool_session_${randomUUID3()}`;
+  const toolSessionId = `tool_session_${randomUUID4()}`;
   const { toolSession } = await apiClient.createToolSession(projectId, {
     toolSessionId,
     repositoryLinkId,
@@ -14870,7 +15152,7 @@ function runnerEnvironmentSetupCommands(setupPackageManagerInstall) {
   return setupPackageManagerInstall ? [{ id: "packageManager.install" }] : [];
 }
 function inferRepoName(root) {
-  return path19.basename(path19.resolve(root)) || "repository";
+  return path20.basename(path20.resolve(root)) || "repository";
 }
 function createRepoFingerprint(accountId, projectId, repositoryLinkId) {
   return createHash9("sha256").update(`${accountId}:${projectId}:${repositoryLinkId}`).digest("hex");
@@ -15148,7 +15430,7 @@ function runnerHeartbeatMetadata(toolConfig, mode = currentRunnerMode(), concurr
   return {
     version: CLI_VERSION,
     mode,
-    hostname: os9.hostname(),
+    hostname: os10.hostname(),
     ...runnerIsolationCapabilityMetadata(),
     maxConcurrentWork: concurrencyMetadata.maxConcurrentWork,
     activeClaimLaneIds: concurrencyMetadata.activeClaimLaneIds,
@@ -15173,9 +15455,9 @@ function runnerHeartbeatMetadata(toolConfig, mode = currentRunnerMode(), concurr
   };
 }
 function runnerMachineId() {
-  return createHash9("sha256").update(`${os9.hostname()}:${os9.platform()}:${os9.arch()}`).digest("hex").slice(0, 20);
+  return createHash9("sha256").update(`${os10.hostname()}:${os10.platform()}:${os10.arch()}`).digest("hex").slice(0, 20);
 }
-async function delay(milliseconds) {
+async function delay2(milliseconds) {
   await new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
 program.parseAsync().catch((error) => {